Evasive Panda Strikes Again: DNS Poisoning Escapades in Cyber-Espionage Comedy!
Evasive Panda strikes again, using DNS poisoning to sneakily install the MgBot backdoor. Think of it as a digital ninja, tiptoeing through Türkiye, China, and India with the subtlety of a panda in a bamboo thicket. The campaign shows the group’s evolving tactics, leaving victims scratching their heads—and their servers!
Hot Take:
Who knew pandas could be so slippery? Turns out, they’re not just cute and cuddly, but also know their way around a keyboard. Evasive Panda is out here delivering backdoors like they’re serving up bamboo appetizers!
Key Points:
- Evasive Panda, a China-linked APT group, is using DNS poisoning to deliver the MgBot backdoor in cyber-espionage campaigns.
- The campaign targets victims in Türkiye, China, and India and has been ongoing from November 2022 to November 2024.
- Attackers use fake software updates to deploy malware, masquerading as trusted applications like SohuVA.
- The malware employs stealthy techniques, including DLL sideloading and adversary-in-the-middle attacks, to remain undetected.
- Kaspersky highlights the group’s persistence and evolving tactics, suggesting other ongoing campaigns might exist.
Already a member? Log in here