Nightdoor

Nightdoor is a complex malware attributed to the Evasive Panda APT group, a China-linked cyber-espionage team known for its diverse attack vectors and focus on surveillance of individuals and organizations in Asia and Africa. The malware was introduced by the group in 2020 and has been used alongside another malicious software, MgBot, which is exclusively deployed by Evasive Panda. Nightdoor communicates with a command-and-control server to issue commands, upload data, and create a reverse shell, effectively turning the victim's machine into an open book. The Evasive Panda group has been targeting Tibetans using the Nightdoor backdoor, leveraging it as part of a larger collection of tools for their operations. The group's arsenal includes known and unknown tools, including downloaders, droppers, and backdoors such as MgBot and Nightdoor. These tools have been used to target several networks in East Asia, indicating the group's geographical focus. ESET researchers first identified Nightdoor earlier this year, highlighting its technical significance due to its complexity. The malware has been deployed against visitors from specific global geographies who are infected with droppers and backdoors, including Nightdoor and MgBot. Despite the complexity and variety of these attacks, it remains uncertain what specific information the threat actors are seeking.