Evasive Panda leverages Monlam Festival to target Tibetans

MITRE Techniques

• [T1583.004] Acquire Infrastructure: Server – Evasive Panda acquired servers for the C&C infrastructure of Nightdoor, MgBot, and the macOS downloader component. (‘Evasive Panda acquired servers for the C&C infrastructure of Nightdoor, MgBot, and the macOS downloader component.’)
• [T1583.006] Acquire Infrastructure: Web Services – Evasive Panda used Google Drive’s web service for Nightdoor’s C&C infrastructure. (‘Evasive Panda used Google Drive’s web service for Nightdoor’s C&C infrastructure.’)
• [T1584.004] Compromise Infrastructure: Server – Operators compromised several servers to use as watering holes, host payloads, and act as C&C. (‘Evasive Panda operators compromised several servers to use as watering holes… and to host payloads and use as C&C servers.’)
• [T1585.003] Establish Accounts: Cloud Accounts – Attackers created a Google Drive account and used it as C&C infrastructure. (‘Evasive Panda created a Google Drive account and used it as C&C infrastructure.’)
• [T1587.001] Develop Capabilities: Malware – The group developed/deployed custom implants such as MgBot and Nightdoor. (‘Evasive Panda deployed custom implants such as MgBot, Nightdoor, and a macOS downloader component.’)
• [T1588.003] Obtain Capabilities: Code Signing Certificates – The campaign used obtained code‑signing certificates to sign macOS binaries. (‘Evasive Panda obtained code‑signing certificates.’)
• [T1608.004] Stage Capabilities: Drive-by Target – The attackers modified a high‑profile website to render a fake notification that prompts a malware download. (‘modified a high-profile website to add a piece of JavaScript code that renders a fake notification to download malware.’)
• [T1189] Drive-by Compromise – Visitors to compromised websites could be enticed by a fake error page to download OS‑specific payloads. (‘Visitors to compromised websites may receive a fake error message enticing them to download malware.’)
• [T1195.002] Supply Chain Compromise: Compromise Software Supply Chain – Official installer packages were trojanized on the software vendor’s site. (‘Evasive Panda trojanized official installer packages from a software company.’)
• [T1106] Native API – Nightdoor, MgBot, and their loaders use native Windows APIs to create processes. (‘Nightdoor, MgBot, and their intermediate downloader components use Windows APIs to create processes.’)
• [T1053.005] Scheduled Task/Job: Scheduled Task – Loader components created scheduled tasks (e.g., creating Demovale task). (‘Nightdoor and MgBot’s loader components can create scheduled tasks.’)
• [T1543.003] Create or Modify System Process: Windows Service – Loader components can create Windows services for persistence. (‘Nightdoor and MgBot’s loader components can create Windows services.’)
• [T1574.002] Hijack Execution Flow: DLL Side-Loading – Droppers use legitimate executables to side‑load malicious DLLs (e.g., RPHost.dll, memmgrset.dll). (‘Nightdoor and MgBot’s dropper components deploy a legitimate executable file that side-loads a malicious loader.’)
• [T1140] Deobfuscate/Decode Files or Information – DLL components are decrypted in memory before use. (‘DLL components of the Nightdoor implant are decrypted in memory.’)
• [T1562.004] Impair Defenses: Disable or Modify System Firewall – Nightdoor adds Windows Firewall rules to allow its proxy/server traffic. (‘Nightdoor adds two Windows Firewall rules to allow inbound and outbound communication for its HTTP proxy server functionality.’)
• [T1070.004] Indicator Removal: File Deletion – Nightdoor and MgBot include file deletion capabilities. (‘Nightdoor and MgBot can delete files.’)
• [T1070.009] Indicator Removal: Clear Persistence – The backdoors can uninstall themselves to clear persistence. (‘Nightdoor and MgBot can uninstall themselves.’)
• [T1036.004] Masquerading: Masquerade Task or Service – Nightdoor disguises tasks (e.g., as netsvcs). (‘Nightdoor’s loader disguised its task as netsvcs.’)
• [T1036.005] Masquerading: Match Legitimate Name or Location – Installer deploys components into legitimate system directories. (‘Nightdoor’s installer deploys its components into legitimate system directories.’)
• [T1027.009] Obfuscated Files or Information: Embedded Payloads – Dropper contains embedded encrypted blobs and payloads that are deployed on disk. (‘Nightdoor’s dropper component contains embedded malicious files that are deployed on disk.’)
• [T1055.001] Process Injection: Dynamic-link Library Injection – Loader components inject into svchost.exe. (‘Nightdoor and MgBot’s loaders components inject themselves into svchost.exe.’)
• [T1620] Reflective Code Loading – Loaders inject into svchost.exe and load backdoors from memory. (‘Nightdoor and MgBot’s loader components inject themselves into svchost.exe, from where they load the Nightdoor or MgBot backdoor.’)
• [T1087.001] Account Discovery: Local Account – Backdoors collect local user account information. (‘Nightdoor and MgBot collect user account information from the compromised system.’)
• [T1083] File and Directory Discovery – Nightdoor and MgBot enumerate files and directories for collection. (‘Nightdoor and MgBot can collect information from directories and files.’)
• [T1057] Process Discovery – The malware collects information on running processes. (‘Nightdoor and MgBot collect information about processes.’)
• [T1012] Query Registry – Backdoors query the Windows registry to find installed software. (‘Nightdoor and MgBot query the Windows registry to find information about installed software.’)
• [T1518] Software Discovery – The implants enumerate installed software and services. (‘Nightdoor and MgBot collect information about installed software and services.’)
• [T1033] System Owner/User Discovery – The malware collects system owner/user details. (‘Nightdoor and MgBot collect user account information from the compromised system.’)
• [T1082] System Information Discovery – Wide system profiling is performed (OS, adapters, CPU, etc.). (‘Nightdoor and MgBot collect a wide range of information about the compromised system.’)
• [T1049] System Network Connections Discovery – Active TCP/UDP connections are enumerated. (‘Nightdoor and MgBot can collect data from all active TCP and UDP connections on the compromised machine.’)
• [T1560] Archive Collected Data – Collected data is stored in encrypted files before exfiltration. (‘Nightdoor and MgBot store collected data in encrypted files.’)
• [T1119] Automated Collection – The implants automatically collect system and network information. (‘Nightdoor and MgBot automatically collect system and network information about the compromised machine.’)
• [T1005] Data from Local System – Backdoors collect OS and user data from local storage. (‘Nightdoor and MgBot collect information about the operating system and user data.’)
• [T1074.001] Data Staged: Local Data Staging – Data is staged locally for exfiltration. (‘Nightdoor and MgBot stages data for exfiltration in files on disk.’)
• [T1071.001] Application Layer Protocol: Web Protocols – Nightdoor uses HTTP-based communications for C2. (‘Nightdoor communicates with the C&C server using HTTP.’)
• [T1095] Non-Application Layer Protocol – Nightdoor can use UDP; MgBot uses TCP. (‘Nightdoor communicates with the C&C server using UDP. MgBot communicates with the C&C server using TCP.’)
• [T1571] Non-Standard Port – MgBot uses TCP port 21010 for C2 communication. (‘MgBot uses TCP port 21010.’)
• [T1572] Protocol Tunneling – Nightdoor can act as an HTTP proxy to tunnel TCP traffic. (‘Nightdoor can act as an HTTP proxy server, tunneling TCP communication.’)
• [T1102] Web Service – Nightdoor leverages Google Drive as a web service for C2. (‘Nightdoor uses Google Drive for C&C communication.’)
• [T1020] Automated Exfiltration – Nightdoor and MgBot automatically exfiltrate collected data. (‘Nightdoor and MgBot automatically exfiltrate collected data.’)
• [T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage – Nightdoor exfiltrates files to Google Drive. (‘Nightdoor can exfiltrate its files to Google Drive.’)