Mgbot

MgBot is a malicious software (malware) used exclusively by the cyber threat group known as Evasive Panda. This malware, along with another custom-made Windows backdoor called Nightdoor, forms part of the group's toolkit for cyber attacks. These tools are typically delivered via malicious downloaders for both Windows and macOS systems. The MgBot malware, in particular, is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. Once inside a system, it can collect information about processes, disrupt operations, steal personal information, and even hold data hostage for ransom. The Evasive Panda attackers have utilized a mix of known and unknown tools, including Nightdoor and MgBot, for their operations. They have acquired servers for the command-and-control (C&C) infrastructure of these malwares, and also deployed a macOS downloader component. Both Nightdoor and MgBot possess self-uninstalling capabilities and can delete files, making them particularly evasive. Their loader components inject themselves into svchost.exe from where they load the respective backdoors. Additionally, specific global geographic visitors to certain sites were targeted with droppers and backdoors, which included Nightdoor and MgBot. Threat intelligence researchers have been able to link two variants of the Macma backdoor to MgBot by identifying overlap with another known tool, Daggerfly. This association was made possible due to the modular architecture of MgBot, which allows it to receive modules to enhance its capabilities and spy on victims. The Evasive Panda group has been known to use watering hole and supply chain tactics, targeting several networks in East Asia with these tools. The ultimate aim of the attackers is to infect website users with MgBot and Nightdoor using malicious downloaders for macOS and Windows.