Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor

China-linked APT Evasive Panda, also known as Daggerfly, Bronze Highland and StormBamboo, ran a targeted cyberespionage campaign that used DNS poisoning to deliver the MgBot backdoor to victims in Türkiye, China and India. According to Kaspersky, the operation has been active across multiple campaigns since November 2022 and continued until November 2024, with attackers deploying adversary-in-the-middle techniques, stealthy loaders and encrypted malware components.

The initial infection relied on fake software updates masquerading as trusted applications, such as a SohuVA update, with DNS poisoning potentially redirecting update requests to attacker-controlled servers. The attackers’ multi-stage process includes a loader written in C++ that decrypts configuration data and then downloads the next stage, sometimes disguising components like libpython2.4.dll and evteng.exe to load malware stealthily.

DNS responses were poisoned so victims could reach attacker infrastructure while believing they were connecting to legitimate sites, and the MgBot payload was repeatedly renamed and re-encrypted to hinder analysis. according to Kaspersky.