MITRE ATT&CKgroup

G1034 Daggerfly

Published 2024-07-25 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Evasive Panda, BRONZE HIGHLAND
Version
1.0
Created
2024-07-25

Description

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.

Related

Uses · MITRE ATT&CK (23)

  • S1146 MgBot software (malware)
  • S1147 Nightdoor software (malware)
  • S1016 MacMa software (malware)
  • T1584.004 Server sub-technique
  • T1587.002 Code Signing Certificates sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1574.001 DLL sub-technique
  • T1195.002 Compromise Software Supply Chain sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1059.001 PowerShell sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1553.002 Code Signing sub-technique
  • T1136.001 Local Account sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1053.005 Scheduled Task sub-technique
  • S0190 BITSAdmin software (tool)
  • T1189 Drive-by Compromise technique
  • S0013 PlugX software (malware)
  • S0075 Reg software (tool)
  • T1012 Query Registry technique
  • T1082 System Information Discovery technique
  • T1105 Ingress Tool Transfer technique

References