Trusted Design

Daggerfly

アクターID: G1034

· MITRE Pageへのリンク

脅威アクターの詳細

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.(Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)(Citation: ESET EvasivePanda 2024)

脅威アクターの別名・別称

Daggerfly
Evasive Panda
BRONZE HIGHLAND

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1583 - Acquire Infrastructure
• T1584.008 - Network Devices
• T1089 - Disabling Security Tools
• T1103 - AppInit DLLs
• T1530 - Data from Cloud Storage
• T1120 - Peripheral Device Discovery
• T1583.004 - Server
• T1497.002 - User Activity Based Checks
• T1573 - Encrypted Channel
• T1174 - Password Filter DLL
• T1570 - Lateral Tool Transfer
• T1059.012 - Hypervisor CLI
• T1556.005 - Reversible Encryption
• T1546.016 - Installer Packages
• T1547.013 - XDG Autostart Entries
• T1027.018 - Invisible Unicode

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2015-1427 (T1584.008)
• CVE-2015-1770 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2015-2546 (T1027.018)
• CVE-2015-3785 (T1584.008)
• CVE-2015-5897 (T1583.004)
• CVE-2015-7645 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-3113 (T1584.008)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2015-4495 (T1059.012)
• CVE-2014-1761 (T1584.008)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1027.018)
• CVE-2013-2094 (T1027.018)
• CVE-2014-4113 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7808 (T1584.008)
• CVE-2012-1889 (T1584.008)
• CVE-2016-1990 (T1584.008)
• CVE-2016-1991 (T1584.008)
• CVE-2016-1010 (T1027.018)
• CVE-2016-0984 (T1027.018)
• CVE-2016-1001 (T1584.008)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1641 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-5749 (T1584.008)
• CVE-2015-3628 (T1584.008)
• CVE-2015-2852 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2015-2853 (T1027.018)
• CVE-2015-7755 (T1584.008)
• CVE-2016-1287 (T1584.008)
• CVE-2015-6585 (T1584.008)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6022 (T1027.018)
• CVE-2015-7262 (T1584.008)
• CVE-2015-8286 (T1584.008)
• CVE-2015-8287 (T1584.008)
• CVE-2016-1562 (T1584.008)
• CVE-2016-2342 (T1584.008)
• CVE-2016-2343 (T1584.008)
• CVE-2017-0263 (T1027.018)
• CVE-2016-6532 (T1584.008)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2017-3212 (T1584.008)
• CVE-2025-61882 (T1584.008)
• CVE-2015-0311 (T1027.018)
• CVE-2010-3081 (T1174)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2012-1258 (T1584.008)
• CVE-2015-0336 (T1027.018)
• CVE-2014-3153 (T1584.008)
• CVE-2014-4322 (T1584.008)
• CVE-2015-3105 (T1584.008)
• CVE-2014-0497 (T1584.008)
• CVE-2014-8361 (T1556.005)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2551 (T1027.018)
• CVE-2014-0569 (T1584.008)
• CVE-2014-0515 (T1584.008)
• CVE-2015-0310 (T1120)
• CVE-2012-4681 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2015-0071 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2010-2883 (T1584.008)
• CVE-2014-7247 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2010-0738 (T1584.008)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1583.004)
• CVE-2010-0232 (T1027.018)
• CVE-2014-3393 (T1584.008)
• CVE-2012-6422 (T1584.008)
• CVE-2013-2595 (T1584.008)
• CVE-2014-3897 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2011-0611 (T1584.008)
• CVE-2013-5990 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2017-7255 (T1584.008)
• CVE-2017-0143 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-24893 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2026-0723 (T1584.008)
• CVE-2026-20127 (T1027.018)
• CVE-2014-6352 (T1497.002)
• CVE-2015-5560 (T1174)
• CVE-2015-0057 (T1027.018)
• CVE-2012-1723 (T1027.018)
• CVE-2013-0634 (T1174)
• CVE-2013-7331 (T1570)
• CVE-2014-0322 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2010-1553 (T1027.018)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2025-55182 (T1027.018)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2017-16929 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2010-1297 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2015-4902 (T1027.018)
• CVE-2009-3129 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2017-0001 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-68645 (T1027.018)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る