Evasive Panda leverages Monlam Festival to target Tibetans

ESET discovered an active cyberespionage campaign attributed to the China-aligned APT Evasive Panda that targeted Tibetan communities by compromising the Kagyu Monlam festival website (watering-hole) and trojanizing Tibetan language translation software installers. The attackers delivered malicious downloaders for Windows and macOS that fetched second-stage payloads, including the established MgBot backdoor and a previously undocumented Windows backdoor dubbed Nightdoor (which used Google Drive for C2). The report provides technical analysis of the infection chains, TTPs, targeted IP ranges across India, Taiwan, Hong Kong, Australia and the US, and a comprehensive set of IoCs and samples.