Nightdoor

Nightdoor is a sophisticated malware developed by the threat group Evasive Panda. This malicious software, designed to exploit and damage computer systems, was first detected in 2022 alongside MgBot, another custom implant developed by the same group. The primary function of Nightdoor is to infiltrate systems surreptitiously through suspicious downloads, emails, or websites, steal personal information, disrupt operations, and potentially exfiltrate data. Notably, Nightdoor utilizes public cloud services for its command and control (C&C) communications, making it a feature-rich backdoor. Alongside Nightdoor, Evasive Panda also developed other custom implants such as MgBot and CloudScout, with the latter being detected in February 2023. On May 26, 2022, the command and control (C&C) servers for both MgBot and Nightdoor were established. In the same month, the network of a Taiwanese religious institution fell victim to an attack orchestrated using these two malware. A year later, in February 2023, CloudScout modules and the Nightdoor implant were found within a suspected Taiwanese government entity, indicating a broadening of the group's target range. The malware has also been used in attacks against a China-based American NGO, an African telecoms operator in 2023, and in various watering hole attacks. The group's toolkit includes another malware known as Suzafk (also referred to as 'NetMM' or 'Nightdoor'), which was linked to Evasive Panda in March. This variant of Nightdoor is loaded onto newly infected systems alongside legitimate programs like DAEMON Tools Lite, establishing persistence via scheduled tasks. The malware has shown evolution over time, with new variants like a UDP variant of MgBot appearing after the initial UDT variant. The continued development and deployment of these tools underscore Evasive Panda's persistent threat to cyber security.