Full Report
ESET researchers discovered a previously undocumented toolset used by Evasive Panda to access and retrieve data from cloud services
Analysis Summary
# Threat Actor: Evasive Panda
## Attribution & Identity
* **Attribution:** China-aligned Advanced Persistent Threat (APT) group.
* **Aliases and Associated Groups:** BRONZE HIGHLAND, Daggerfly, StormBamboo.
* **Operational History:** Operating since at least 2012.
## Activity Summary
Evasive Panda is conducting cyberespionage operations primarily targeting organizations and countries opposing China’s interests. Recent activity between 2022 and 2023 involved the deployment of the **CloudScout** post-compromise toolset in Taiwan. This toolset was used to target a government entity (detected February 2023) and a religious organization (detected May 2022). The objective appears to be the theft of cloud-stored data. The group has also been observed extending operations to countries like Vietnam, Myanmar, and South Korea.
## Tactics, Techniques & Procedures
Evasive Panda utilizes sophisticated vectors, including supply-chain attacks, watering-hole attacks, DNS hijacking, and exploitation of recent CVEs affecting Microsoft Office, Confluence, and web servers. The group possesses a strong malware development capability across Windows, macOS, and Android.
Specific TTPs related to the observed campaign include:
* **Initial Access/Execution:** Exploitation of CVEs, deployment of MgBot.
* **Persistence:** MgBot modifies the registry to ensure persistence ([T1112]).
* **Privilege Escalation:** MgBot performs UAC bypass ([T1548.002]).
* **Defense Evasion:** Gmck component decrypts browser databases to obfuscate configuration data ([T1140], [T1027]). Modules masquerade as legitimate NVIDIA processes/directories ([T1036.005]).
* **Credential Access:** Stealing web session cookies via the Gmck component ([T1539]).
* **Discovery:** MgBot collects system information ([T1082]).
* **Collection:** Using CloudScout modules (CGD, CGM, COL) to steal data from Google Drive, Gmail, and Outlook by hijacking active web sessions using stolen cookies ([T1550.004], [T1530], [T1114.002]). Modules use SharpZipLib to compress data before exfiltration ([T1560.001]).
* **Command and Control:** MgBot communicates with C2 via UDP ([T1095]).
* **Exfiltration:** Exfiltration occurs over the C2 channel ([T1041]).
## Targeting
* **Sectors:** Government entities, religious institutions.
* **Geography:** Primarily Taiwan (specific targeting evidence includes using Taipei Standard Time and Chinese language packs [zh-CN] in web requests). Past targeting has included organizations related to Tibetan diaspora independence movements, religious and academic institutions in Taiwan and Hong Kong, and democracy supporters in China.
* **Victims:** A government entity in Taiwan, a religious institution in Taiwan.
## Tools & Infrastructure
* **Malware Families Used:**
* **CloudScout:** A modular .NET toolset (C#) designed specifically for accessing victim cloud services via stolen cookies. Modules analyzed target Google Drive (CGD), Gmail (CGM), and Outlook (COL).
* **MgBot:** Signature malware framework (C++) used for initial deployment, persistence, C2 communication, and deploying CloudScout plugins.
* **Nightdoor:** A feature-rich backdoor utilizing public cloud services for C&C communications, observed alongside MgBot in the Taiwanese incidents.
* **Gmck:** A component responsible for decrypting browser databases (Chrome, Edge, Firefox) to steal cookies.
* **Infrastructure:** C2 communication observed via UDP using MgBot.
* **URLs/IPs:** (None explicitly listed as defanged in the source text, though the description implies C2 infrastructure exists for MgBot.)
## Implications
Evasive Panda demonstrates a high level of evasion and stealth by relying on stolen web session cookies to bypass traditional authentication controls like 2FA. The use of a modular framework like CloudScout, which integrates with established malware like MgBot, allows for targeted, low-footprint collection of sensitive cloud data. The group’s continued focus on groups related to Chinese political opposition necessitates high vigilance for organizations in sensitive sectors globally, particularly those operating within or associated with Taiwan. The development of specific modules tailored to Taiwanese user settings indicates dedication to successful compromise in these specific environments.
## Mitigations
* Monitor for the deployment and execution of the **CloudScout** modules or plugins associated with **MgBot**.
* Implement defense mechanisms that counter cookie theft, such as **Device Bound Session Credentials (DBSC)** or **App-Bound Encryption** features (currently in Chrome 127+) to potentially render cookie-stealing malware obsolete.
* Investigate and monitor for suspicious activity related to the compromise of cloud service APIs/sessions, especially those using session cookies retrieved from browser databases.
* Strengthen defenses against UAC bypass techniques ([T1548.002]).
* Monitor for processes masquerading as legitimate system components, such as attempts to place files in directories mimicking NVIDIA paths ([T1036.005]).