Daggerfly

Introduction

Daggerfly is a People’s Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns. Symantec Daggerfly 2023 ESET EvasivePanda 2023 Symantec Daggerfly 2024 ESET EvasivePanda 2024

Activities and Tactics

Targeted Sectors: Government, Individuals, Universities

Country of Origin: 🇨🇳 China

Incident Type: Espionage

Suspected Victims: Hong Kong, Malaysia, India, Taiwan, Macao, Nigeria

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1003.002 Security Account Manager
• T1587.002 Code Signing Certificates
• T1053.005 Scheduled Task
• T1071.001 Web Protocols
• T1059.001 PowerShell
• T1036.003 Rename Legitimate Utilities
• T1204.001 Malicious Link
• T1105 Ingress Tool Transfer
• T1082 System Information Discovery
• T1195.002 Compromise Software Supply Chain
• T1574.001 DLL
• T1218.011 Rundll32
• T1584.004 Server
• T1136.001 Local Account
• T1553.002 Code Signing
• T1012 Query Registry
• T1189 Drive-by Compromise

ATT&CK technique IDs (denormalized)

• T1003.002
• T1012
• T1036.003
• T1053.005
• T1059.001
• T1071.001
• T1082
• T1105
• T1136.001
• T1189
• T1195.002
• T1204.001
• T1218.011
• T1553.002
• T1574.001
• T1584.004
• T1587.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• PlugX (S0013) — malware
• MgBot (S1146) — malware
• BITSAdmin (S0190) — tool
• MacMa (S1016) — malware
• Nightdoor (S1147) — malware
• Reg (S0075) — tool

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [4] ESET EvasivePanda 2024 Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024. [5] ESET EvasivePanda 2023 Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024. [6] Symantec Daggerfly 2023 Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024. [7] Symantec Daggerfly 2024 Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.