A sophisticated cyber-espionage operation has been attributed to Evasive Panda, a China-affiliated Advanced Persistent Threat (APT) actor also tracked under the aliases Bronze Highland, Daggerfly, and StormBamboo. Active since approximately 2012, the group has established a long-standing record of highly targeted intrusion campaigns aligned with strategic intelligence-collection objectives.

Since November 2022 Evasive Panda conducted a focused and sustained campaign primarily affecting organizations and individuals across Türkiye, China, and India. The activity demonstrated a strong emphasis on selective victim profiling, with operations tailored to specific regional, political, and strategic contexts rather than broad, opportunistic targeting.

Technical Approach: DNS Manipulation and Man-in-the-Middle Operations

The attack strategy relied heavily on Adversary-in-the-Middle (AitM) tactics, specifically exploiting DNS response manipulation. The group’s methodology involved:

  • Intercepting and altering victim DNS queries to redirect network traffic toward attacker-operated infrastructure
  • Hosting encrypted malicious components on controlled servers, which were delivered when victims attempted to access legitimate websites
  • Installing loader malware at specific system locations on compromised machines

Previous DNS Poisoning Activities

This campaign represents a continuation of Evasive Panda’s established DNS poisoning operations:

  • ESET identified potential AitM or supply chain attacks in April 2023, where the group distributed weaponized versions of legitimate software including Tencent QQ
  • Volexity documented an ISP compromise in August 2024, where DNS poisoning facilitated the delivery of malicious software updates
  • Evasive Panda operates alongside other China-associated APT groups (LuoYu, BlackTech, TheWizards APT, and related actors) that similarly employ AitM methods for network infiltration and lateral movement

Attack Implementation Details

Analysis from Kaspersky revealed that the group disguised their malware as legitimate software updates, such as those for the SohuVA video streaming platform. The malicious update originated from p2p.hd.sohu.com[.]cn, demonstrating DNS compromise.

Multi-Stage Infection Process:

  1. Entry Point: Malicious loader deployment on target systems
  2. Shellcode Execution: The loader runs shellcode that retrieves an encrypted secondary shellcode (camouflaged as a PNG image file) through additional DNS poisoning targeting dictionary[.]com
  3. DNS Hijacking: The threat actors manipulated DNS resolution for dictionary[.]com, causing victims to reach a malicious IP address depending on their geographic location and ISP. The precise DNS poisoning mechanism remains unclear, though likely vectors include ISP infrastructure compromise or direct exploitation of victim routers and firewalls
  4. Operating System Fingerprinting: HTTP requests for the secondary shellcode transmitted the victim’s Windows version, indicating customized payloads tailored to specific operating systems

Malware Deployment and Encryption Scheme:

A second-stage loader (libpython2.4.dll) is executed through DLL side-loading using a legacy version of python.exe. This component:

  • Accesses the file located at C:\ProgramData\Microsoft\eHome\perf.dat
  • Processes a payload initially protected with XOR encryption, then decrypted using custom hybrid encryption that merges Microsoft’s Data Protection API (DPAPI) with the RC5 cipher
  • Employs machine-specific encryption that binds the payload to the infected system, preventing decryption on other machines and hindering security analysis

Ultimate Payload: MgBot Backdoor Implant

The final decrypted component is a version of the MgBot modular backdoor, which is injected into a legitimate svchost.exe process. MgBot delivers comprehensive espionage functionality:

  • Exfiltration of files
  • Recording of keystrokes
  • Capturing clipboard contents
  • Audio recording capabilities
  • Extraction of credentials from web browsers

These features enable sustained, covert access within compromised networks.

The campaign was characterized by stealthy initial access vectors, persistent foothold techniques, and careful operational security designed to minimize detection and attribution. Observed tradecraft suggests a mature adversary with experience in long-term surveillance, data exfiltration, and credential harvesting, consistent with state-sponsored espionage objectives. The group’s tooling and infrastructure exhibited frequent rotation and compartmentalization, further complicating defensive analysis and response. Evasive Panda continues to refine its operational tactics, combining advanced DNS poisoning techniques, sophisticated hybrid encryption, and multi-layered payload delivery mechanisms to circumvent security defenses and establish persistent footholds in targeted environments for intelligence collection operations.

References: