Evasive Panda

Evasive Panda, also known as StormBamboo, Daggerfly, or Bronze Highland, is a threat actor group linked to China that has been operating since at least 2012. The group primarily focuses on cyber espionage against civil society targets and has demonstrated significant technical capabilities. They have developed and deployed custom implants including MgBot, Nightdoor, CloudScout, and a macOS downloader component. These tools are used in conjunction with each other, with CloudScout working seamlessly with MgBot, Evasive Panda’s signature malware framework. The group acquired servers for the command and control (C&C) infrastructure of these tools, further enhancing their operational capacity. In August, it was reported by Volexity researchers that Evasive Panda successfully compromised an undisclosed internet service provider (ISP) to poison DNS responses for target organizations. This sophisticated approach underscores the group's ability to infiltrate and manipulate network systems. Furthermore, the group's CloudScout toolset stands out due to its professional design and its role in stealing data stored in cloud services. It targets multiple cloud apps, including Google Drive, Gmail, and Outlook, demonstrating the group's interest in cloud-stored documents, user profiles, and emails for its espionage operations. The CloudScout toolset, written in .NET, is designed to retrieve data from various cloud services by leveraging stolen web session cookies. Its seamless integration with MgBot, Evasive Panda’s proprietary malware framework, reveals the group's strategic approach to cyberespionage. A notable incident in 2022 involved the compromise of two machines from a religious institution in Taiwan by Evasive Panda, indicating the group's wide range of targets. Overall, Evasive Panda represents a significant cybersecurity threat with advanced capabilities and a focus on cloud-based data extraction.