Evasive Panda APT Using AitM Attack and DNS Poisoning to Deliver Malware

The report describes Evasive Panda (aka Bronze Highland/Daggerfly/StormBamboo) conducting targeted campaigns from Nov 2022 through Nov 2024 that use DNS poisoning and adversary-in-the-middle attacks to deliver MgBot disguised as legitimate software updates; the multi-stage infection employs XOR/RC5/DPAPI hybrid encryption, DLL sideloading, and process injection to evade detection and maintain persistence, impacting victims in Türkiye, China, and India.