Daggerfly

Overview

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.

Targets

Government · Individuals · Universities

Regions

Hong Kong · India · Macao · Malaysia · Nigeria · Taiwan

Capabilities

• Supply-chain compromise — ATT&CK T1195.002
• Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 17 techniques across 9 tactics

Tools & malware (6)

PlugX · MgBot · BITSAdmin · MacMa · Nightdoor · Reg

Reporting (3)

• Daggerfly: Espionage Group Makes Major Update to Toolset — Threat Hunter Team
• Evasive Panda leverages Monlam Festival to target Tibetans — Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé
• Evasive Panda APT group delivers malware via updates for popular Chinese software — Facundo Muñoz