Evasive Panda APT: Malware Delivery via AitM and DNS Poisoning
## Cybersecurity: Evasive Panda Threat Analysis
Cybersecurity: Evasive Panda Threat Analysis
Evasive Panda, also known as Bronze Highland, Daggerfly, and StormBamboo, has enhanced its threat capabilities through a two-year campaign utilizing advanced techniques such as adversary-in-the-middle (AitM) attacks and DNS poisoning.
Research indicates that from November 2022 to November 2024, the group consistently targeted individuals in Turkey, China, and India with evolving malware delivery methods to avoid detection.
Evasive Panda's loader, developed in C++ using the Windows Template Library (WTL), employs encryption and obfuscation to hinder analysis. It uses XOR-based decryption to reveal configuration elements only during execution, ensuring that critical strings are encrypted until runtime.
The attackers have created an injector that allows the in-memory execution of their MgBot implant within legitimate processes, using DLL sideloading with the signed executable evteng.exe to maintain persistence without writing primary payloads to disk.
Evasive Panda, also known as Bronze Highland, Daggerfly, and StormBamboo, has enhanced its threat capabilities through a two-year campaign utilizing advanced techniques such as adversary-in-the-middle (AitM) attacks and DNS poisoning.
The campaign's DNS poisoning mechanism targeted legitimate websites, redirecting users to attacker-controlled servers based on their location and ISP. The malware downloaded encrypted payloads disguised as PNG images, with payloads customized to the victim's Windows version and system configuration.
The infection chain involves multi-stage execution, with the initial loader decrypting shellcode and retrieving encrypted payloads via DNS-poisoned traffic. A combination of Microsoft's Data Protection API (DPAPI) and RC5 encryption was utilized to prevent interception and analysis.
Some systems remained compromised for over a year, indicating a sustained commitment to maintaining operations. Multiple command-and-control (C2) servers were active for extended periods, suggesting infrastructure redundancy to withstand potential takedowns.
Attribution to Evasive Panda is supported by tactical similarities with historical operations, including supply-chain compromise, AitM techniques, and watering-hole attacks. Despite detailed visibility, the initial method of network compromise for DNS poisoning remains undetermined, with potential scenarios involving ISP network implants or compromised network devices.
The campaign reflects ongoing evolution in Evasive Panda’s capabilities, suggesting further developments are anticipated. Organizations are advised to implement DNS monitoring, network segmentation, and endpoint detection mechanisms to counteract multi-stage shellcode execution patterns.
Based on reporting by GBHackers.
