Evasive Panda APT Delivers MgBot Malware via AitM and DNS Poisoning

First seen 24 Dec 2025, 19:09 UTC • Gbhackers

•81% similarity •44

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Evasive Panda APT group, also known as Bronze Highland, has been conducting targeted campaigns since November 2022, utilizing adversary-in-the-middle (AitM) attacks and DNS poisoning to deliver the MgBot malware. These operations have affected multiple industries and continued until November 2024.

ThreatCluster AI

Attack Flow

8 entities, 15 inferred relationships (STIX 2.1).

Threat Actor (5)

Bronze Highland
Daggerfly
Evasive Panda
Evasive Panda APT Group
StormBamboo

Technique (2)

Malware
Man-in-the-Middle

Malware (1)

MgBot

Relationships

Bronze Highland uses MgBot
Daggerfly uses MgBot
Evasive Panda uses MgBot
Evasive Panda APT Group uses MgBot
StormBamboo uses MgBot
Bronze Highland uses Malware
Bronze Highland uses Man-in-the-Middle
Daggerfly uses Malware
Daggerfly uses Man-in-the-Middle
Evasive Panda uses Malware
Evasive Panda uses Man-in-the-Middle
Evasive Panda APT Group uses Malware
Evasive Panda APT Group uses Man-in-the-Middle
StormBamboo uses Malware
StormBamboo uses Man-in-the-Middle

Community

Browse all →

Evasive Panda APT Delivers MgBot Malware via AitM and DNS Poisoning

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading