Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor

Securityaffairs.Co •Pierluigi Paganini • December 29, 2025

China-linked APT Evasive Panda used DNS poisoning to deliver the MgBot backdoor in targeted cyber-espionage attacks in Türkiye, China, and India. Kaspersky researchers spotted the China-linked APT group Evasive Panda (aka Daggerfly, Bronze Highland, and StormBamboo) running a targeted cyber-espionage campaign using DNS poisoning to deliver the MgBot backdoor against victims in Türkiye, China, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Evasive Panda APT Uses DNS Poisoning to Deploy MgBot Malware in Targeted Attacks The China-linked APT group Evasive Panda has conducted cyber-espionage campaigns using DNS poisoning to install the MgBot backdoor. Targeted victims include entities in Türkiye, China, and India. Kaspersky researchers have identified this group, also known by several other names, as responsible for these attacks. 3 sources 52

Extracted Entities

Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor

The full story

Extracted Entities

APT Groups (4)

Attack Types (1)

Campaigns (1)

Countries (3)

Malware (1)