An alleged group with ties to the Chinese government, known as Daggerfly, which also goes by Evasive Panda and Bronze Highland, has significantly updated its collection of cyber tools. This update includes new versions of its malware, likely in an effort to avoid detection after their older variants were exposed by recent research.
The group has introduced a new malware family based on their widely-used MgBot malware and a new iteration of the Macma macOS backdoor. Researchers from a cybersecurity firm noted that Daggerfly is adept at quickly adapting its tools to continue its espionage activities with minimal disruption.
Daggerfly has utilized these new tools in several recent attacks, targeting organizations in Taiwan and a high-profile international NGO operating in two Chinese provinces. The malware was distributed through messaging software developed by a major Chinese tech company.
Before the NGO attack last April, Daggerfly had targeted an African telecommunications company using the MgBot malware among other tools.
Regarding malware updates, one of the tools that received multiple updates is the Macma macOS backdoor, first identified by a major tech company in 2021. While Macma had not been previously attributed to any specific group, evidence now suggests it was developed by Daggerfly. For instance, two variants of the Macma backdoor were found to connect to a command-and-control server that was also used by a MgBot dropper.
Another addition to Daggerfly’s toolkit is a Windows backdoor named Suzafk, which was first observed in March 2024 being used alongside MgBot. Suzafk was developed using the same shared library as MgBot, Macma, and several other Daggerfly tools.
The latest findings provide a clearer understanding of Daggerfly’s capabilities and resources. The group has demonstrated the ability to create versions of its tools that target most major operating system platforms, including Android and Solaris.
The continuous evolution of cyber threats like those from Daggerfly underscores the need for vigilance and adaptive security measures in the digital domain. As cyber adversaries refine their strategies, so must the defenders of digital spaces to protect against such sophisticated attacks.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
