Nightdoor

Nightdoor is a complex malware attributed to the Evasive Panda Advanced Persistent Threat (APT) group, a China-linked cyber-espionage team. This group has typically focused on surveillance of individuals and organizations in Asia and Africa. The malware was first introduced by the group in 2020 and is used alongside other tools such as MgBot, which is exclusively used by Evasive Panda. Nightdoor communicates with a command-and-control server to issue commands, upload data, and create a reverse shell, effectively making an infected machine an "open book". The Evasive Panda APT group has been active in recent years, with MgBot being used in attacks against a China-based American NGO, an African telecoms operator in 2023, and in watering hole attacks late last year. In these attacks, Nightdoor worked alongside MgBot and was loaded onto newly infected systems alongside legitimate programs. Another malware, Suzafk (also known as ‘NetMM’ or Nightdoor), was observed in the group's toolkit and linked to Evasive Panda by ESET researchers in March 2024. The group has targeted Tibetans using the Nightdoor backdoor, leveraging various attack vectors. The use of Nightdoor and MgBot allows the group to gain significant access to the victim's system, although it remains unclear what specific information they are after. The researchers have also highlighted Daggerfly’s use of the Windows backdoor Suzafk, which ESET first documented as Nightdoor in March 2024. The threat actors behind Daggerfly are also deploying this new Windows backdoor, further emphasizing the wide reach and impact of this ongoing cyber-espionage campaign.