Evasive Panda APT Targets DNS to Deploy MgBot

Securelist

Evasive Panda APT Targets DNS to Deploy MgBot

First seen 24 Dec 2025, 13:03 UTC • •42.8

Article Content

1 / 2

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The Evasive Panda APT group has conducted targeted campaigns from November 2022 to November 2024, employing adversary-in-the-middle (AitM) attacks. Their tactics included poisoning DNS requests to deliver the MgBot malware, affecting multiple industries with their sophisticated methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 227d ago How this analysis works

More articles in this cluster (1)

Threat Graph

22 entities, 59 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (4)

Bronze Highland
Daggerfly
Evasive Panda APT
StormBamboo

Technique (3)

DLL Sideloading
Malware
Man-in-the-Middle

Organization (2)

IObit
IQIYI

Malware (2)

Macma
MgBot

Indicator (4)

1c36452c2dad8da95d460bee3bea365e
7973e0694ab6545a044a49ff101d412a
9e72410d61eaa4f24e0719b34d7cad19
c340195696d13642ecf20fbe75461bed

Affected Platform (3)

Tencent
MacOS
Windows

Tool (4)

Evteng.exe
Libpython2.4.dll
Qiyiservice.exe
Windows Template Library

Relationships

Bronze Highland uses Macma
Bronze Highland uses MgBot
Daggerfly uses Macma
Daggerfly uses MgBot
Evasive Panda APT uses Macma
Evasive Panda APT uses MgBot
StormBamboo uses Macma
StormBamboo uses MgBot
Bronze Highland uses Evteng.exe
Bronze Highland uses Libpython2.4.dll
Bronze Highland uses Qiyiservice.exe
Bronze Highland uses Windows Template Library
Daggerfly uses Evteng.exe
Daggerfly uses Libpython2.4.dll
Daggerfly uses Qiyiservice.exe
Daggerfly uses Windows Template Library
Evasive Panda APT uses Evteng.exe
Evasive Panda APT uses Libpython2.4.dll
Evasive Panda APT uses Qiyiservice.exe
Evasive Panda APT uses Windows Template Library
StormBamboo uses Evteng.exe
StormBamboo uses Libpython2.4.dll
StormBamboo uses Qiyiservice.exe
StormBamboo uses Windows Template Library
Bronze Highland uses DLL Sideloading
Bronze Highland uses Malware
Bronze Highland uses Man-in-the-Middle
Daggerfly uses DLL Sideloading
Daggerfly uses Malware
Daggerfly uses Man-in-the-Middle
Evasive Panda APT uses DLL Sideloading
Evasive Panda APT uses Malware
Evasive Panda APT uses Man-in-the-Middle
StormBamboo uses DLL Sideloading
StormBamboo uses Malware
StormBamboo uses Man-in-the-Middle
Macma communicates with 1c36452c2dad8da95d460bee3bea365e
Macma communicates with 7973e0694ab6545a044a49ff101d412a
Macma communicates with 9e72410d61eaa4f24e0719b34d7cad19
Macma communicates with c340195696d13642ecf20fbe75461bed
MgBot communicates with 1c36452c2dad8da95d460bee3bea365e
MgBot communicates with 7973e0694ab6545a044a49ff101d412a
MgBot communicates with 9e72410d61eaa4f24e0719b34d7cad19
MgBot communicates with c340195696d13642ecf20fbe75461bed
Bronze Highland targets IObit
Bronze Highland targets IQIYI
Daggerfly targets IObit
Daggerfly targets IQIYI
Evasive Panda APT targets IObit
Evasive Panda APT targets IQIYI
StormBamboo targets IObit
StormBamboo targets IQIYI
Macma targets IObit
Macma targets IQIYI
MgBot targets IObit
MgBot targets IQIYI
Bronze Highland related to Tencent
Bronze Highland related to MacOS
Bronze Highland related to Windows

Following this threat?

Track Bronze Highland, Macma and IObit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

.NET Vulnerability CVE-2026-111497 Requires Immediate Action On October 25, 2026, Microsoft released out-of-band security updates for.NET addressing CVE-2026-111497, a vulnerability in the Brotli decompression algorithm that allows unauthorized attackers to elevate privileges over a network. The flaw affects.NET versions 8, 9, 10, and 11, particularly in applications that…

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…