Daggerfly
Daggerfly is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 9 sectors, including Government and Technology, in 21 countries, including the United States and India. It uses 103 MITRE ATT&CK techniques and exploits 3 known CVEs.
- BRONZE HIGHLAND
- Evasive Panda
- Techniques
- 103
- Exploited CVEs
- 3
- First seen
- Jan 1, 2012
- Last seen
- Nov 1, 2024
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
103 techniques across 14 of 15 tacticsVulnerabilities They Exploit.
Browse Vulnerability Intelligence →Linked through malware and tools
Targeted by malware or tools Daggerfly uses; not reported as exploited by the actor itself.
Arsenal · Malware And Tools.
- CloudScoutmalware
- DNS request interception toolsmalware
- Korplugmalware
- libpython2.4.dllmalware
- MacMamalware
- Malware families targeting Solaris OSmalware
- MgBotmalware
- MgBot-Based Familymalware
- Nightdoormalware
- ShadowPad Loadermalware
- SMS interception toolsmalware
- Sshdinjectormalware
- Trojan.Suzafkmalware
- Trojanized Android APKsmalware
- BITSAdmintool
- Cobalt Striketool
- evteng.exetool
- Microsoft Data Protection API (DPAPI)tool
- python.exetool
- Regtool
Showing 20 of 21 malware families and tools. 1 more is in restricted Brandefense intelligence. Request a demo
Campaigns.
- ShinyHunters Healthcare and Customer Data Extortion 2026Apr 2026 to Jun 2026
- Evasive Panda DNS Poisoning and MgBot CampaignNov 2022 to Nov 2024
Indicators Of Compromise.
TLP:CLEAR- Hash
d9eec27bf827669cf13bfdb7be3fdb0fdf05a26d5b74adecaf2f0a48105ae934 - IP
60[.]28[.]124[.]21
134 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Daggerfly.
Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. MITRE states that Daggerfly has targeted individuals, government and NGO entities, and telecommunications companies in Asia and Africa, and is associated with exclusive use of MgBot malware. Treat the actor as suspected-active unless internal CTI confirms post-2024 operations.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.