Quick Summary
A China-linked advanced persistent threat group, Evasive Panda, has conducted a targeted cyber espionage campaign using DNS poisoning to deliver MgBot malware. This activity, observed from November 2022 to November 2024, primarily affected victims in Türkiye, China, and India. The group has a history of using adversary-in-the-middle attacks and has previously targeted software updates to distribute malicious payloads, demonstrating its advanced capabilities in evading security measures.
The Securityish Brief
The Evasive Panda group, also known as Bronze Highland, Daggerfly, and StormBamboo, has been active since at least 2012. Their recent campaign involved DNS poisoning to deliver the MgBot backdoor, specifically targeting victims in Türkiye, China, and India between November 2022 and November 2024. Kaspersky researchers noted that the group employed adversary-in-the-middle (AitM) attacks, which included dropping loaders in specific locations and storing encrypted malware components on attacker-controlled servers.
This is not the first instance of Evasive Panda utilizing DNS poisoning. In April 2023, ESET reported similar tactics where the group delivered trojanized applications, such as Tencent QQ, to an international NGO in Mainland China. Additionally, a report from Volexity in August 2024 highlighted how the group compromised an unnamed ISP to push malicious software updates to specific targets.
Understanding the Attack Mechanism
The attacks involved lures masquerading as updates for legitimate software, including SohuVA, with malicious updates delivered from the domain “p2p.hd.sohu.com[.]cn.” The attackers likely altered DNS responses to redirect victims to their servers, allowing them to serve malicious payloads. The initial loader fetched encrypted shellcode via DNS poisoning, which was then decrypted and executed on victim systems.
In the documented attacks, Evasive Panda manipulated the IP address associated with dictionary[.]com, causing victims’ systems to resolve it to an attacker-controlled IP. The exact method of DNS poisoning remains unclear, but it is suspected that either ISPs were compromised or routers used by victims were hacked.
The malware, MgBot, is capable of extensive data harvesting, including logging keystrokes and stealing credentials from web browsers. This modular implant allows the attackers to maintain a stealthy presence within compromised systems for extended periods.
Kaspersky’s analysis indicates that Evasive Panda has advanced capabilities, employing complex techniques to evade detection and maintain persistence in targeted systems. Their use of custom encryption methods complicates analysis and detection efforts.
- Evasive Panda: A China-linked APT group known for targeted cyber espionage campaigns.
- MgBot: A backdoor malware variant used by Evasive Panda to harvest sensitive data.
- DNS Poisoning: A technique used to redirect victims to malicious servers by altering DNS responses.
- Adversary-in-the-Middle (AitM) Attacks: A method where attackers intercept and manipulate communications between victims and legitimate services.
- SohuVA: A legitimate video streaming service targeted by Evasive Panda for malicious updates.
Key Takeaways
- Regularly update all software to protect against vulnerabilities that could be exploited by malware like MgBot.
- Monitor DNS settings for unauthorized changes that could indicate DNS poisoning attacks.
- Educate users about the risks of downloading software updates from unverified sources.
- Implement robust network security measures to detect and prevent AitM attacks.
- Consider using DNS filtering services to block access to known malicious domains.
Key Terms & Concepts
- Evasive Panda: In this article, Evasive Panda refers to a China-linked advanced persistent threat group involved in cyber espionage.
- MgBot: MgBot is a backdoor malware variant used by Evasive Panda to harvest sensitive data from compromised systems.
- DNS Poisoning: DNS poisoning is a technique that alters DNS responses to redirect users to malicious servers.
- Adversary-in-the-Middle (AitM) Attacks: AitM attacks involve intercepting and manipulating communications between victims and legitimate services.
- SohuVA: SohuVA is a legitimate video streaming service targeted by Evasive Panda for delivering malicious updates.
Read the original article here: https://thehackernews.com/2025/12/china-linked-evasive-panda-ran-dns.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
