Evasive Panda APT poisons DNS requests to deliver MgBot
ID: 623a4a70-4b05-5193-becb-ef381f84bc1b
STIX ID: report--623a4a70-4b05-5193-becb-ef381f84bc1b
Feed Name: Securelist by Kaspersky
Threat Score
**Evasive Panda (aka Bronze Highland/Daggerfly/StormBamboo) ran a highly targeted, multi-stage AitM campaign from Nov 2022–Nov 2024 that leveraged fake updaters, DNS poisoning, custom loaders and in-memory injection to deploy the MgBot implant; the report details infection vectors, loader and shellcode behavior, hybrid DPAPI/RC5 payload storage, persistence mechanisms, victims in Türkiye/China/India, and numerous IoCs including file hashes, file paths and C2 IPs.**
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.