Evasive Panda

Evasive Panda, also known as StormBamboo and DaggerFly, is a threat actor group linked to China, primarily targeting organizations across Asia that have interest in the Chinese state. The group has been observed deploying custom implants such as MgBot, Nightdoor, and a macOS downloader component, along with trojanizing official installer packages from a software company. These actions are part of a broader campaign aimed at compromising target organizations through various methods, including DNS poisoning and leveraging legitimate software update channels for malicious purposes. Evasive Panda's signature backdoor, MgBot, along with its toolkit of plugin modules, is a key part of their operations. In August 2023, researchers at Volexity reported that Evasive Panda had successfully compromised an undisclosed internet service provider (ISP) to poison DNS responses for target organizations. This involved using DNS poisoning to host a modified config file indicating a new update was available, resulting in the targeted software downloading an upgrade package from the APT's server that had already been backdoored with malicious code. In one notable incident, applications seeking updates installed malware instead of the intended updates, specifically Macma and Pocostick, both commonly used by Evasive Panda. The Evasive Panda group has also targeted Tibetan nationals in India and the United States, and another related group, dubbed ToddyCat, has targeted groups in Vietnam and Taiwan. In March, experts observed another malware, Suzafk (aka ‘NetMM’, Nightdoor), linked to Evasive Panda. The group continues to evolve its toolset, introducing several new versions of its malware in response to exposure of older variants, indicating an ongoing commitment to internal espionage.