China-Linked Evasive Panda Ran DNS Poisoning Campaign to Deliver MgBot Malware

A China-linked advanced persistent threat group known as Evasive Panda was linked to a targeted cyber espionage campaign that poisoned DNS requests to deliver its MgBot backdoor in attacks aimed at victims in Türkiye, China and India.

The activity, observed between November 2022 and November 2024, is described by Kaspersky as involving adversary-in-the-middle techniques, including dropping loaders in specific locations and storing encrypted parts of the malware on attacker-controlled servers that were resolved via targeted DNS requests.

The group has previously used DNS poisoning in other operations, with Lures masquerading as updates for software such as Sohu’s SohuVA and other applications like Baidu’s iQIYI Video, IObit Smart Defrag and Tencent QQ. In these campaigns, victims’ DNS responses to dictionary[.]com could be redirected to attacker-controlled IPs based on location and ISP, enabling a first loader to fetch an encrypted second-stage shellcode and MgBot payload.

The MgBot variant is said to be capable of harvesting files, logging keystrokes, collecting clipboard data, recording audio and stealing browser credentials, with a secondary loader using libpython2.4.dll and a perf.dat file to decrypt and launch the payload, sustaining long-term presence on compromised systems, according to Kaspersky.