Evasive Panda APT poisons DNS requests to deliver MgBot

The Evasive Panda APT group, also known as Bronze Highland, Daggerfly, and StormBamboo, has been active since 2012 and ran highly-targeted campaigns from November 2022 to November 2024, according to Securelist’s GReAT research.

In this latest analysis, the attackers are described as using adversary-in-the-middle techniques, including dropping loaders in specific locations and storing encrypted components on attacker-controlled servers, with a new loader designed to evade detection and hybrid encryption making implants unique to each victim.

The operation allegedly used DNS poisoning to alter responses for legitimate sites such as dictionary[.]com, delivering payloads via a malicious update package disguised as SohuVA, a streaming app from Sohu Inc, with the first-stage loader decrypting and loading MgBot into memory. Victims have been detected in Türkiye, China, and India, with some systems compromised for more than a year, and the campaign’s persistence spanning two years.

The analysis also reveals a secondary loader chain, a Python-based module misused to load MgBot, and a multi-stage shellcode approach that ultimately exposes a hardcoded set of C2 addresses and a configuration used to maintain control over infected hosts.