The China-linked advanced persistent threat (APT) group Evasive Panda, also tracked as Bronze Highland, Daggerfly, or StormBamboo, continues to prove its sophistication with a recently uncovered campaign that leveraged Adversary-in-the-Middle (AitM) attacks and DNS poisoning to deploy its long-running MgBot malware family.
Active since 2012, the group maintained this stealthy campaign from November 2022 to November 2024, targeting victims in China, India, and Türkiye across multiple industries.
Targeted fake updater attacks
Securelist observed that Evasive Panda distributed malicious executables disguised as legitimate software updates for trusted applications, including SohuVA, iQIYI Video, IObit Smart Defrag, and Tencent QQ.
One such file, sohuva_update_10.2.29.1-lup-s-tp.exe, impersonated a genuine update from Sohu Inc. and retrieved malicious code from a manipulated update domain, p2p.hd.sohu.com[.]cn.
Investigators believe the attackers used DNS poisoning to redirect legitimate update requests to attacker-controlled IP addresses, delivering a custom C++ loader built with the Windows Template Library (WTL).
The loader decrypted its configuration with an XOR-based algorithm, uncompressed data using LZMA, and installed malware components under %ProgramData%\Microsoft\MF. Notably, all crucial strings, including user and process names, were stored in encrypted form to evade analysis.
The loader executed multiple stages of shellcode, each decrypted via XOR and dynamically loaded using the VirtualProtect API.
The shellcode used the PJW hashing algorithm to resolve Windows APIs at runtime, enabling stealth execution.
It also used the CryptUnprotectData API to decrypt unique DAT files that run only on the infected machine, ensuring individualized payload delivery.
DNS-manipulated payload delivery and hybrid encryption
In later stages, the malware retrieved an encrypted payload masquerading as a PNG image from a spoofed version of the dictionary.]com, again using DNS poisoning to redirect traffic.
The payloads were tailored to the victim’s Windows version, suggesting a selective targeting mechanism that may determine whether to deploy Windows (MgBot) or macOS (Macma) implants.
The secondary loader, libpython2.4.dll, was sideloaded via evteng.exe, a signed binary, and used hybrid encryption that combined Microsoft’s Data Protection API (DPAPI) and the RC5 algorithm.
This ensured that decrypted payloads could only be read on the infected host. The decrypted payload was then injected into legitimate processes, such as svchost.exe, to run the MgBot implant in memory.
Researchers linked the activity to Evasive Panda through overlapping toolsets, C2 infrastructure, and the reuse of the MgBot implant, which has remained a central tool in the group’s espionage toolkit.
C2 infrastructure used in the operation included IPs 60.28.124[.]21, 123.139.57[.]103, and 103.96.130[.]107, with telemetry showing persistent access over two years.
Evasive Panda’s latest campaign demonstrates how the threat actor is refining traditional attack methods through network-level manipulation and misuse of data protection, underscoring the evolving nature of long-term cyber espionage threats.
Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.
 group Evasive Panda, also tracked as Bronze Highland, Daggerfly.){kind=link}