Loading story…
The Evasive Panda advanced persistent threat (APT) group, also known as Bronze Highland, Daggerfly, and StormBamboo, has conducted targeted campaigns since November 2022 using sophisticated adversary-in-the-middle (AitM) attacks and DNS poisoning to deliver the MgBot malware. The group targets victims in Türkiye, China, and India by disguising malicious executables as legitimate software updates for popular applications such as SohuVA, iQIYI Video, IObit Smart Defrag, and Tencent QQ. Attackers manipulate DNS responses to redirect update requests to attacker-controlled servers, where users unknowingly download malware-laden packages like sohuva_update_10.2.29.1-lup-s-tp.exe. The malware employs advanced evasion techniques, including encrypted payload delivery, memory injection via DLL sideloading, and hybrid encryption to make detection and analysis more difficult.
Technical analysis reveals that the initial loader decrypts its configuration and shellcode using XOR-based algorithms, checks for SYSTEM privileges, and leverages the VirtualProtect API to execute code stealthily. The group stores encrypted malware components on their servers, which are resolved through poisoned DNS responses, further complicating detection. The MgBot implant is injected into legitimate processes, allowing the attackers to maintain persistence and evade security controls for extended periods. Indicators of compromise and further technical details are available through specialized threat intelligence services.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
In June 2025, Kaspersky reported on the campaign and assessed with high confidence that it was conducted by Evasive Panda, also known as Bronze Highland, Daggerfly, and StormBamboo. The attribution was based on the observed tactics, techniques, and procedures and the use of the MgBot malware family.
Kaspersky's reporting indicates the documented activity it analyzed was observed from November 2022 through November 2024. This marks the end of the specific campaign period covered in the research.
Across the November 2022 to November 2024 campaign window, victims were observed in Türkiye, China, and India, with some systems remaining under attacker control for more than a year. The operators maintained multiple command-and-control IPs and used per-victim encryption to support long dwell time and hinder analysis.
As the operation evolved, Evasive Panda used a multi-stage loader with shellcode, XOR/LZMA obfuscation, API hashing, and hybrid encryption to fetch and execute payloads with minimal disk artifacts. The final stage loaded the MgBot implant in memory through DLL sideloading into a signed older Python wrapper executable, then injected into legitimate processes such as svchost.exe.
During the campaign, the group abused legitimate platforms and update mechanisms, including requests for dictionary.com and software such as SohuVA, iQIYI, IObit Smart Defrag, and Tencent QQ, to deliver staged malware. Redirection and payload delivery were tailored by victim geography or ISP, complicating detection and investigation.
Evasive Panda began a highly targeted campaign in November 2022, using adversary-in-the-middle techniques likely involving DNS poisoning to redirect legitimate software update requests to attacker-controlled infrastructure. Early delivery chains impersonated trusted software updaters to infect selected victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026