Evasive Panda APT Hijacks Dictionary.com and App Updates in Two-Year Spree

A new report describes Evasive Panda, a cyber-espionage group (also known as StormBamboo or Daggerfly), conducting a two-year campaign that hijacked software updates and DNS responses to deliver malware. Targeting victims in China, India, and Türkiye between November 2022 and November 2024, the operation used Adversary-in-the-Middle attacks to redirect traffic and deliver payloads via seemingly legitimate updates.

Researchers noted the attackers impersonated SohuVA and compromised update mechanisms for other software, including the iQIYI Video application, IObit Smart Defrag, and Tencent QQ, by dropping fake updaters into legitimate installation folders. A striking tactic involved retrieving the second-stage payload from dictionary[.]com, with the encrypted shellcode masqueraded as a PNG file and delivered based on geography and ISP.

The group employs a hybrid encryption scheme using Microsoft’s DPAPI and the RC5 algorithm to secure payloads on disk, tying stolen data to the infected machine, while MgBot remains the ultimate backdoor delivered by a loader masquerading as libpython2.4.dll. According to Kaspersky Labs, the attackers continue to refine AiTM capabilities, raising persistence and stealth as they evolve their toolkit.