Daggerfly

Executive Summary

Daggerfly, also known as Evasive Panda and BRONZE HIGHLAND, is a People's Republic of China-linked Advanced Persistent Threat (APT) group active since at least 2012. Known for targeting government entities, NGOs, and telecommunications companies in Asia and Africa, Daggerfly primarily uses the MgBot malware and has been associated with supply chain infection campaigns. The group employs sophisticated tactics, including code signing abuse and malicious scripts, to maintain persistence and exfiltrate data.

Goals & Targeting

Daggerfly's strategic objectives appear to focus on espionage and intelligence collection, targeting sectors that align with Chinese strategic interests in Asia and Africa. The group's selection of government entities suggests a focus on political and diplomatic intelligence. Their targeting of telecommunication companies may aim to disrupt critical infrastructure or gather sensitive information. The geographic concentration in Asia and Africa likely reflects both regional interests and accessibility to targets.

Daggerfly is a state-sponsored APT group attributed to China, operating since at least 2012. The group primarily targets government agencies, non-governmental organizations (NGOs), and telecommunication companies across Asia and Africa. Daggerfly's activity has been linked to several high-profile incidents involving supply chain compromises, where the group seeks to infiltrate systems through third-party software providers. The group is known for using MgBot malware, a versatile backdoor tool designed for long-term persistence and data exfiltration. Additionally, Daggerfly employs various techniques to maintain stealth and evade detection, including the use of legitimate utilities and code signing certificates to disguise malicious activities.

Key Capabilities

• Use of MgBot malware for long-term persistence
• Supply chain infection campaigns
• Code signing abuse
• Abuse of legitimate tools (e.g., rundll32)
• Malicious scripts delivered via PowerShell
• DLL injection techniques
• Scheduled task creation

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Daggerfly has been involved in several long-term campaigns targeting government and telecommunication sectors. The group's operations suggest a patient, strategic approach with a focus on maintaining persistence within targeted networks. Campaign patterns include supply chain infections, where the group compromises third-party vendors to infiltrate downstream customers. Notable past operations involve malicious scripts delivered via spear-phishing emails and legitimate-looking executables.

IOC Patterns

• Malware distribution through supply chain infections
• Use of rundll32 for execution
• Scheduled task creation with legitimate tools
• DLL injection techniques
• Abuse of code signing certificates

Recommended Actions

• Implement supply chain security measures to detect and mitigate third-party compromises.
• Monitor network traffic for unusual script executions (e.g., PowerShell, CMD).
• Deploy endpoint detection and response (EDR) solutions to identify and block known Daggerfly TTPs.
• Conduct regular audits of scheduled tasks and legitimate utilities for signs of unauthorized activity.

Suggested Tags