Evasive Panda ran targeted adversary-in-the-middle campaigns from November 2022 to November 2024, using poisoned DNS responses and fake updaters to deliver a new loader that ultimately deployed the MgBot implant. The operation used DLL sideloading, in-memory process injection, and a DPAPI+RC5 hybrid encryption scheme to create victim-unique encrypted payloads and long-lived C2 infrastructure. #EvasivePanda #MgBot
Keypoints
- Campaign timeframe: highly targeted operations observed between November 2022 and November 2024 with victims in Türkiye, China, and India.
- Initial vector: fake updaters for legitimate apps (e.g., SohuVA, iQIYI) and likely DNS-poisoning AitM techniques to redirect legitimate update/download requests to attacker servers.
- Multi-stage loader chain: C++ WTL-based loader that decrypts/configures payloads (XOR, LZMA), executes staged shellcode, and retrieves a second-stage payload from attacker-controlled web resources.
- Stealth and persistence: new loader plus a decade-old signed executable used for DLL side-loading and runtime injection of an MgBot implant into legitimate processes (e.g., svchost.exe).
- Hybrid, machine-bound encryption: attackers stored payloads using an RC5 key encrypted with DPAPI, tying decryption to the infected host and producing unique, hard-to-analyze DAT files.
- Extensive C2 infrastructure and long-term ops: numerous hardcoded IP-based C2 servers used over multiple years to maintain control and persistence.
MITRE Techniques
- [T1557 ] Adversary-in-the-Middle – Used to redirect legitimate website requests to attacker servers and serve payloads; ‘adversary-in-the-middle (AitM) attacks’.
- [T1574.002 ] DLL Side-Loading – Loader uses a signed legacy executable to load a malicious DLL and execute payloads; ‘resides in the memory space of a decade-old signed executable by using DLL sideloading’.
- [T1055 ] Process Injection – Implant executed in memory by injecting it into legitimate processes to maintain stealth; ‘allows them to execute their MgBot implant in memory by injecting it into legitimate processes’.
- [T1105 ] Ingress Tool Transfer – Second-stage shellcode and payloads retrieved from web resources controlled by the attacker (disguised as legitimate content); ‘obtained the encrypted second-stage shellcode, disguised as a PNG file, from the legitimate website dictionary[.]com’.
- [T1071.001 ] Application Layer Protocol: Web Protocols – HTTP requests with custom headers used to request tailored payloads and fingerprint OS versions; ‘sec-ch-ua-platform: windows %d.%d.%d.%d.%d.%d’.
- [T1195 ] Supply Chain Compromise – Use of forged update packages and fake updaters to distribute malware under the guise of legitimate software updates; ‘supply-chain compromise’.
- [T1189 ] Drive-by Compromise (Watering Hole) – Use of legitimate websites (e.g., dictionary[.]com) manipulated to serve payloads to targeted victims; ‘watering-hole attacks’.
- [T1027 ] Obfuscated Files or Information – Multiple stages of XOR obfuscation, compressed buffers, and encrypted strings to conceal configuration and code; ‘all relevant strings in the malware, such as SYSTEM and ext.exe, are encrypted, and the loader decrypts them with a specific XOR algorithm’.
Indicators of Compromise
- [File Hashes ] Malicious payloads and loaders – c340195696d13642ecf20fbe75461bed (sohuva_update_10.2.29.1-lup-s-tp.exe), 7973e0694ab6545a044a49ff101d412a (libpython2.4.dll), and 1 more hash.
- [File Names ] Deployed artifacts – sohuva_update_10.2.29.1-lup-s-tp.exe (fake SohuVA updater), libpython2.4.dll (secondary loader/disguised library).
- [File Paths ] Persistence and staging locations – C:ProgramDataMicrosoftMF (malware installation), C:ProgramDataMicrosofteHomeperf.dat (encrypted staged payload), C:ProgramDataMicrosofteHomestatus.dat (loader state file).
- [Domains/URLs ] Malicious/abused web resources – p2p.hd.sohu.com[.]cn (fake update redirect resource), dictionary[.]com (abused to host disguised second-stage shellcode).
- [IP Addresses ] Hardcoded C2 and AitM infrastructure – 60.28.124[.]21 (MgBot C2), 123.139.57[.]103 (MgBot C2), and other 13 items.