ESET EvasivePanda 2024

Nightdoor gathers information on victim system network configuration such as MAC addresses.

Nightdoor gathers information on victim system users and usernames.

Daggerfly has attempted to use scheduled tasks for persistence in victim environments.

Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.

Nightdoor can self-delete.

Nightdoor uses TCP and UDP communication for command and control traffic.

Daggerfly uses HTTP for command and control communication.

Nightdoor gathers information on the victim system such as CPU and Computer name as well as device drivers.

Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.

Nightdoor can utilize Microsoft OneDrive or Google Drive for command and control purposes.

Nightdoor can identify the system local time information.

Daggerfly has used strategic website compromise for initial access against victims.

Daggerfly is associated with several supply chain compromises using malicious updates to compromise victims.

Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems. Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.

Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.

Daggerfly created code signing certificates to sign malicious macOS files.

Nightdoor can collect information about disk drives, their total and free space, and file system type.