StormBamboo — Threat Actor Profile, Campaigns & Targets

Related Threat Clusters

• Evasive Panda APT Uses DNS Poisoning to Deploy MgBot Malware in Targeted Attacks

  The China-linked APT group Evasive Panda has conducted cyber-espionage campaigns using DNS poisoning to install the MgBot backdoor. Targeted victims include entities in Türkiye, China, and India. Kaspersky researchers…

  3 articles · Updated January 1, 2026
• Evasive Panda APT Delivers MgBot Malware via AitM and DNS Poisoning

  The Evasive Panda APT group, also known as Bronze Highland, has been conducting targeted campaigns since November 2022, utilizing adversary-in-the-middle (AitM) attacks and DNS poisoning to deliver the MgBot malware.…

  3 articles · Updated December 24, 2025
• Evasive Panda APT Targets DNS to Deploy MgBot

  The Evasive Panda APT group has conducted targeted campaigns from November 2022 to November 2024, employing adversary-in-the-middle (AitM) attacks. Their tactics included poisoning DNS requests to deliver the MgBot…

  1 article · Updated December 24, 2025

Recent Intelligence Reports

• Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor — Securityaffairs.Co · December 29, 2025
• Evasive Panda APT Using AitM Attack and DNS Poisoning to Deliver Malware — Cybersecuritynews · December 24, 2025
• Evasive Panda APT poisons DNS requests to deliver MgBot — Securelist · December 24, 2025

Related Entities