Chinese Panda APT Hacking Websites To Infect Windows And MacOS Users

Evasive Panda dubbed BRONZE HIGHLAND and Daggerfly, a Chinese-speaking APT group operating since at least 2012, has been spotted conducting cyberespionage targeting individuals in mainland China, Hong Kong, Macao, and Nigeria. 

Southeast and East Asian governments, notably those in China, Macao, Myanmar, the Philippines, Taiwan, and Vietnam, were the targets of attacks. The targets included other Chinese and Hong Kong groups.

Since 2020, Evasive Panda has been capable of using adversary-in-the-middle attacks to spread its backdoors by obtaining updates from legitimate software.

“The group uses its own custom malware framework with a modular architecture that allows its backdoor, known as MgBot, to receive modules to spy on its victims and enhance its capabilities,” ESET researchers shared with Cyber Security News.

Specifics Of The Cyberespionage Campaign

Since September 2023, Tibetans have been the victims of a cyberespionage campaign that was uncovered.

It used a supply-chain compromise to distribute trojanized installers of software that translated Tibetan language and a targeted watering hole, also known as a strategic web compromise. 

The hijacked website being used as a watering hole is owned by the Kagyu International Monlam Trust, an Indian organization that spreads Tibetan Buddhism worldwide.

The attackers intended to use malicious downloaders for macOS and Windows to infect website users with MgBot and a backdoor known as Nightdoor. 

MgBot, which is used exclusively by Evasive Panda, can provide attackers with a significant amount of information about compromised machines.

Nightdoor was first discovered in 2020, the Google Drive API or UDP is the two ways the backdoor and its C&C server can communicate.

First, the attackers installed a script on the website that checks the IP address of the possible victim and, if it falls within one of the targeted addresses.

The script sends an HTTP request to determine whether the attacker’s intermediary downloader is currently operating on the possible victim’s computer.

The implant responds on a previously hacked system with handleCallback({“success”:true }).

Subsequently, it displays a fake error page that convinces the user to download a “fix” called certificate (which, depending on the operating system, ends in.exe for Windows or.pkg for macOS). 

Depending on the user’s operating system, a script that downloads a payload is triggered when they click the “Immediate Fix” button.

Researchers suspect that at the time, the attackers took advantage of the Monlam festival that was scheduled to take place in January and February of 2024 to compromise individuals who visited the website that had turned into a watering hole.

The attackers deployed a number of downloaders, droppers, and backdoors, such as Nightdoor, the most recent significant addition to the group’s toolkit, which has been used to target multiple networks in East Asia.

With Perimeter81 malware protection, you can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits. All are incredibly harmful and can wreak havoc on your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.