Automation · API / MCP 中文

Group profile · G1034

Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.

ATT&CK G1034 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2024

Showing 2024 citations only; facet pages stay out of the index and canonicalise to the profile.

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.1234

  1. Symantec Daggerfly 2023
  2. ESET EvasivePanda 2023
  3. Symantec Daggerfly 2024
  4. ESET EvasivePanda 2024

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
uses_techniquetech_t1003.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0032024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1195.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0112024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1584.0042024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1136.0012024 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022024 → …100src_mitre_attck_enterprise
uses_techniquetech_t10122024 → …100src_mitre_attck_enterprise
uses_techniquetech_t11892024 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1003.002Security Account Manager—
T1012Query Registry—
T1036.003Rename Legitimate Utilities—
T1053.005Scheduled Task—
T1059.001PowerShell—
T1071.001Web Protocols—
T1082System Information Discovery—
T1105Ingress Tool Transfer—
T1136.001Local Account—
T1189Drive-by Compromise—
T1195.002Compromise Software Supply Chain—
T1204.001Malicious Link—
T1218.011Rundll32—
T1553.002Code Signing—
T1574.001DLL—
T1584.004Server—
T1587.002Code Signing Certificates—

Aliases

BRONZE HIGHLAND · Daggerfly · Evasive Panda

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections