Evasive Panda

THREAT ACTOR PROFILE

Evasive Panda

Daggerfly

Evasive Panda is a China-linked espionage group active since around 2012 that runs cross-platform operations against government, NGO, telecom and diaspora targets, with a long focus on Tibetan communities, Taiwan and East Asia. It is known for the MgBot and Nightdoor backdoors, macOS and Linux implants, and access techniques ranging from ISP compromise to DNS poisoning and supply-chain attacks.

Country:

China

Government / NGO / Telecom

First seen

2012

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Evasive Panda, Daggerfly and BRONZE HIGHLAND

Evasive Panda is tracked under several vendor names tied to its long history. It maps to one entry among the Chinese APT groups we track, and its regional espionage overlaps with other China-linked crews like Mustang Panda.

GROUP PROFILE

Cross-platform espionage with MgBot

Evasive Panda is a China-linked actor built for long-term surveillance across operating systems. It maintains Windows, macOS and Linux implants and reaches targets through a range of access methods, from strategic web compromises to ISP-level interference.

Our record places its origin as China and ties it to espionage against government, NGO, telecom and diaspora targets. Kaspersky documented a 2022 to 2024 campaign using DNS cache poisoning and adversary-in-the-middle to deliver MgBot in Turkiye, China and India.

The group's tradecraft includes fake software updaters, DLL side-loading, ISP compromise to push malicious updates, and the pass-the-cookie CloudScout toolset for hijacking cloud sessions.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

DNS poisoning and fake updates into MgBot

The stages below come from Evasive Panda, Daggerfly and StormBamboo activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

MgBot, Nightdoor and CloudScout

Initial Access

CVES EXPLOITED

Server and driver flaws in targeted intrusions

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

DNS poisoning, CloudScout and Tibetan targeting

Recent reporting tracks the group's access methods and tooling.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through