THREAT_ACTOR · G1034
Daggerfly
Also known as: Daggerfly, Evasive Panda, BRONZE HIGHLAND
Profile
Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.
MITRE ATT&CK ↗Techniques
17 ATT&CK techniques attributed to this actor.
T1003.002 Security Account ManagerT1012 Query RegistryT1036.003 Rename Legitimate UtilitiesT1053.005 Scheduled TaskT1059.001 PowerShellT1071.001 Web ProtocolsT1082 System Information DiscoveryT1105 Ingress Tool TransferT1136.001 Local AccountT1189 Drive-by CompromiseT1195.002 Compromise Software Supply ChainT1204.001 Malicious LinkT1218.011 Rundll32T1553.002 Code SigningT1574.001 DLLT1584.004 ServerT1587.002 Code Signing Certificates
Software
6 malware/tools attributed to this actor.
PlugXRegBITSAdminMacMaMgBotNightdoor
Related corpus activity
10,075 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Daggerfly.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
Showing the top 30 by severity of 10,075.