Daggerfly gets in through software people already trust: legitimate update channels, official download sites and community websites that were quietly altered to serve its implants to chosen visitors. This profile covers the group MITRE ATT&CK tracks as G1034 Daggerfly, also known as Evasive Panda and BRONZE HIGHLAND, which ATT&CK describes as a People's Republic of China-linked APT active since at least 2012. It draws on ATT&CK v20 and on primary research from ESET and Symantec, and it uses each source's own attribution wording. It is written for SOC analysts, threat intelligence teams and the people who run software distribution, telecoms networks and NGO or diaspora community IT. It stays at behaviour level: what to detect and what to harden. For the wider context, see the China State Cyber Operations Guide.
Key takeaways
- Trusted delivery is the signature. ESET documented MgBot arriving through the Tencent QQ updater and, in 2024, trojanised installers on a Tibetan software developer's official site; ATT&CK maps both to T1195.002 Compromise Software Supply Chain.
- Victims are selected, not sprayed. The 2024 watering hole checked each visitor's IP address against a list before showing a fake browser error page that offered a malicious "fix".
- It works across platforms. MgBot and Nightdoor on Windows, MacMa on macOS, and Symantec reports evidence of trojanised Android apps and Linux and Solaris tooling.
- Stored credentials are a prime target. MgBot plugins steal mail client, browser, FileZilla and WinSCP credentials and cookies, and the group dumps the SAM, SYSTEM and SECURITY hives with reg.exe.
- Cloud storage can be the command channel. ESET saw Nightdoor use the Google Drive API for command and control and Symantec saw OneDrive configured, so blocking bad IP addresses alone will not catch it.
Who they are (names and aliases)
ATT&CK describes Daggerfly as a PRC-linked entity that has targeted individuals, government and NGO entities and telecommunications companies in Asia and Africa, and associates it with exclusive use of the MgBot framework. ESET calls the group China-aligned and attributes its 2023 and 2024 reporting to Evasive Panda with high confidence, on the basis that MgBot has not been linked to any other group. Symantec's 2023 telecoms report is more cautious about a related cluster, rating an overlap with another actor as moderate confidence and noting that tool sharing among China-linked groups makes high-confidence attribution difficult.
| Name | Used by | Notes |
|---|---|---|
| Daggerfly (G1034) | MITRE ATT&CK; Symantec | Primary ATT&CK name |
| Evasive Panda | ESET; ATT&CK alias | ESET's naming in its MgBot and Monlam reporting |
| BRONZE HIGHLAND | ATT&CK alias | Listed as an alias by ATT&CK and Symantec |
No source used for this page names individuals, and this page names none.
Software associated in ATT&CK
| Software | Platform | What ATT&CK and vendors say |
|---|---|---|
| MgBot (S1146) | Windows | Modular backdoor used since at least 2012; plugins for credential theft, keylogging, audio capture, file and removable media collection, and Active Directory enumeration (ESET, Symantec) |
| Nightdoor (S1147) | Windows | Backdoor that Symantec tracks as Suzafk; scheduled task persistence, a command shell over pipes, Google Drive API (ESET) or OneDrive (Symantec) as C2 options |
| MacMa (S1016) | macOS | Backdoor with screen capture, keylogging, audio capture and file transfer; Symantec linked it to Daggerfly in 2024 through shared C2 infrastructure and shared library code |
| PlugX (S0013) | Windows | Loaders side-loaded through a legitimate security product in the African telecoms intrusion (Symantec) |
| BITSAdmin (S0190); Reg (S0075) | Windows | Built-in utilities used to fetch payloads and dump registry hives |
For the PlugX family, see the PlugX and ShadowPad Malware Guide.
Targeting and motivation
- Motivation: espionage. Collection focuses on communications, chat history, credentials and documents.
- Communities: Tibetan users across India, Taiwan, Australia, the United States and Hong Kong in the 2024 Monlam festival campaign, with a confirmed victim in Japan (ESET).
- NGOs: members of an international NGO in mainland China in the QQ updater campaign (ESET), and a US NGO based in China in 2024 (Symantec).
- Telecoms: an African telecommunications operator from November 2022 (Symantec). See the Telecoms Threat Actors Guide.
- Taiwan: organisations in Taiwan (Symantec) and a Taiwanese religious organisation that shared C2 infrastructure with the Monlam campaign (ESET).
- Who should care: software publishers with small user bases that matter to a state, civil society and diaspora groups, telecoms operators and anyone running Exchange or Apache servers exposed to the internet.
Tactics and techniques (MITRE ATT&CK)
All IDs below are ATT&CK v20 techniques recorded against G1034, grouped by tactic. The table shows the most defensively useful selection, not every relationship.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Resource development | T1584.004 Server; T1587.002 Code Signing Certificates | Compromised the web server hosting software downloads; created an Apple Development certificate to sign macOS files | Harden and monitor publishing infrastructure; certificate monitoring |
| Initial access | T1195.002 Compromise Software Supply Chain | Malicious updates and trojanised installers from official channels | Signed updates verified on the client; release integrity checks |
| Initial access | T1189 Drive-by Compromise; T1204.001 Malicious Link | Strategic website compromise with a fake error page prompting a download | Browser isolation for high-risk users; block unsigned downloads |
| Execution | T1059.001 PowerShell; T1105 Ingress Tool Transfer | PowerShell and BITSAdmin used to pull follow-on payloads and AnyDesk | PowerShell logging (Event ID 4104); alert on BITS jobs to unusual hosts |
| Persistence | T1053.005 Scheduled Task; T1136.001 Local Account | Nightdoor loader persistence; local accounts created with net user | Alert on Event IDs 4698 and 4720 outside change windows |
| Stealth | T1574.001 DLL; T1218.011 Rundll32; T1036.003 Rename Legitimate Utilities | Side-loading through signed software; rundll32 renamed to dbengin.exe in ProgramData\Microsoft\PlayReady | Application control; alert on signed binaries running from ProgramData |
| Defence impairment | T1553.002 Code Signing | macOS files signed but not notarised | Gatekeeper enforcement; block unnotarised software via MDM |
| Credential access | T1003.002 Security Account Manager; T1012 Query Registry | reg.exe save of SAM, SYSTEM and SECURITY hives | Alert on reg save of those hives; Windows LAPS |
| Discovery | T1082 System Information Discovery | OS details used to build custom User-Agent strings for C2 | Proxy anomaly detection on User-Agent values |
| Command and control | T1071.001 Web Protocols | HTTP C2; cloud storage APIs used as a channel | TLS inspection where lawful; cloud storage API allowlists |
For the technique in depth, see MITRE ATT&CK T1195 Supply Chain Compromise and MITRE ATT&CK T1189 Drive-by Compromise.
How they abuse identities and credentials
- Developer signing identities: in 2024 the group used an Apple Development certificate issued three days before it signed the malicious Mach-O, and Apple revoked it after ESET reported it. A fresh, valid signature is not evidence of trust; notarisation and publisher identity checks are. See the Code Signing Security Guide.
- Publisher web and build credentials: the update supply chain attacks required control of a vendor's download server. The credentials, SSH keys and hosting panel logins that can change a download page are non-human access paths that deserve the same protection as a signing key.
- Stored application credentials: MgBot plugins harvest saved credentials from Outlook, Foxmail, browsers, FileZilla and WinSCP. Saved SFTP and FTP credentials on an administrator workstation often unlock servers, so they should live in a vault, not a client.
- Local accounts and hives: SAM dumping plus newly created local accounts give durable access. Unique local administrator passwords through Windows LAPS limit the value of one dump. See T1003 OS Credential Dumping.
- Cloud storage tokens: Nightdoor variants that use Google Drive or OneDrive carry API credentials for attacker-controlled accounts. Tenant restrictions that allow only corporate cloud storage tenants break that channel.
Notable activity
| Date | Activity | Source |
|---|---|---|
| 2020 to 2021 (found January 2022) | MgBot delivered through the Tencent QQ Windows updater to NGO members in mainland China; ESET could not determine whether update servers were compromised or traffic was intercepted in transit | ESET, April 2023 |
| From November 2022 | Intrusion at an African telecoms operator with new MgBot plugins, PlugX loaders and AnyDesk on an Exchange server | Symantec, April 2023 |
| September 2023 to January 2024 | Watering hole on a Tibetan Buddhist festival website and trojanised Windows and macOS installers on a Tibetan software developer's site | ESET, March 2024 |
| Reported July 2024 | MacMa linked to Daggerfly; Nightdoor (Suzafk) variants; Taiwan targets and a US NGO in China accessed through an Apache HTTP server vulnerability | Symantec, July 2024 |
Symantec notes the group can update its tooling quickly after public exposure, so indicator lists from these reports age fast. Behaviour-based detection lasts longer.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Updater or installer processes spawning unexpected children or writing executables to %TEMP% | EDR; Sysmon Event ID 1 and 11 | Malicious updates run under the trusted updater's process tree |
| reg.exe save of hklm\sam, hklm\system or hklm\security | EDR command line; Event ID 4688 with command line logging | Hive dumping precedes credential extraction |
| rundll32 running under another file name, or signed binaries in ProgramData loading unsigned DLLs | EDR; Sysmon Event ID 7 | Side-loading and renamed utilities |
| BITS jobs and PowerShell downloads of remote access tools | Microsoft-Windows-Bits-Client log; PowerShell Event ID 4104 | Follow-on tooling arrives this way |
| New local accounts and scheduled tasks | Event IDs 4720 and 4698 | Persistence recorded in ATT&CK |
| Non-corporate Google Drive or OneDrive API traffic from servers or unusual processes | Proxy; CASB; firewall | Cloud storage used as C2 |
| New LaunchAgents and unnotarised software on Macs | macOS endpoint security telemetry; MDM | The 2024 macOS payload used a LaunchAgent |
Phased response plan
- Protect your own distribution channel (publishers): sign every release, publish hashes on a separate channel, require MFA and hardware keys for the accounts that can change download pages, and monitor the download server for file changes. See the M1045 Code Signing page.
- Verify what you install (consumers): deploy software through a managed catalogue, check signatures and notarisation, and keep Gatekeeper enforcement on through MDM. Pilot stricter application control in audit mode first and keep the previous policy for rollback.
- Protect high-risk users: journalists, NGO staff and diaspora community administrators should use managed devices with automatic updates from the OS vendor and security keys for accounts.
- Constrain credentials: deploy Windows LAPS, remove saved credentials from FTP, SFTP and mail clients, and alert on registry hive dumping.
- Control cloud egress: restrict cloud storage to corporate tenants and alert on API use by unexpected processes.
- Prepare to respond: if a trusted installer is found trojanised, treat every host that ran it in the window as compromised and coordinate with the publisher. See the Compromised Code Signing Certificate Playbook.
Decision guidance
- Small organisations and NGOs: managed devices, OS-vendor updates, security keys and a short allowlist of approved software remove most of the documented chain.
- Software publishers: your users inherit your security. Separate build, signing and web publishing credentials, and alert on any change to download files.
- Telecoms and large enterprises: add hunting for side-loading, hive dumps and remote access tools on Exchange and other internet-facing servers, and segment those servers from the core.
Metrics
- Percentage of installed software delivered through a managed, signature-checked catalogue.
- Percentage of Windows endpoints with Windows LAPS and command line process logging enabled.
- Number of Macs allowing unnotarised software (target zero).
- Number of servers able to reach personal cloud storage APIs (target zero).
- Time from a publisher compromise advisory to identification of every affected host.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Supply chain and supplier risk | SR-3, SR-11 | GV.SC-07 |
| Software integrity and signature checks | SI-7, CM-7 | PR.PS-02 |
| Authentication of users and services | IA-2 | PR.AA-03 |
| Endpoint and network monitoring | SI-4, AU-6 | DE.CM-01, DE.CM-09 |
| Awareness for high-risk users | AT-2 | PR.AT-01 |
Common failure patterns
- Trusting the updater: processes launched by a legitimate updater are often excluded from scrutiny, which is exactly the path the QQ campaign used.
- Treating a valid signature as proof: a newly issued developer certificate signed the 2024 macOS payload.
- IP-only blocking: cloud storage C2 blends with normal traffic, and the group retools after exposure.
- Weak publisher hygiene at small vendors: a niche software site with a single shared hosting login can become the entry point for a whole community.
- Saved credentials in clients: FTP, SFTP and mail clients storing passwords give MgBot plugins easy pickings.
Practitioner checklist
- Deploy software only from a managed catalogue with signature and notarisation checks.
- Keep Gatekeeper enforcement on and block unnotarised apps through MDM.
- Alert on reg.exe save of SAM, SYSTEM and SECURITY hives.
- Alert on renamed system binaries and signed binaries loading DLLs from ProgramData.
- Log BITS jobs, PowerShell script blocks, Event IDs 4698 and 4720.
- Restrict cloud storage access to corporate tenants.
- Remove saved credentials from FTP, SFTP and mail clients; use a vault.
- Publishers: MFA on hosting and release accounts, file integrity monitoring on download servers, signed releases.
Standards and references
- MITRE ATT&CK: Daggerfly (G1034)
- ESET: Evasive Panda leverages Monlam Festival to target Tibetans
- ESET: Evasive Panda APT group delivers malware via updates of popular Chinese software
- Symantec: Daggerfly espionage group refreshes toolset in ongoing attacks
- Symantec: Daggerfly APT actor targets telecoms company in Africa
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: ATT&CK macOS Malware Software Hub · ATT&CK Remote Access Trojans Software Hub · China State Cyber Operations Guide · Mustang Panda Threat Actor Profile Guide · APT41 Threat Actor Profile · macOS Security Guide for Enterprises · MITRE ATT&CK T1195 Supply Chain Compromise