Skip to content

Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.

ATT&CK ID: G1034
Origin: China
Techniques: 17
Tools: 6

Also tracked as Evasive Panda · BRONZE HIGHLAND

Techniques

Resource Development

Compromise Infrastructure Develop Capabilities

Initial Access

Drive-by Compromise Supply Chain Compromise

Execution

Scheduled Task/Job Command and Scripting Interpreter User Execution Hijack Execution Flow

Persistence

Scheduled Task/Job Create Account

Privilege Escalation

Scheduled Task/Job

Stealth

Masquerading System Binary Proxy Execution Hijack Execution Flow

Defense Impairment

Subvert Trust Controls

Credential Access

OS Credential Dumping

Discovery

Query Registry System Information Discovery

Command and Control

Application Layer Protocol Ingress Tool Transfer

Software

BITSAdmin · MacMa · MgBot · Nightdoor · PlugX · Reg

MITRE ATT&CK All threat actors