Evasive Panda, also known as StormBamboo, Daggerfly, and Bronze Highland, is a China-linked cyber espionage group that has been active since at least 2012. This sophisticated threat actor has been implicated in various high-profile cyberattacks, targeting organizations across mainland China, Hong Kong, Macao, Nigeria, and several Southeast and East Asian countries. Recent investigations by multiple cybersecurity firms have highlighted the group’s advanced tactics and persistent efforts to compromise targets. In mid-2023, Evasive Panda was found to have compromised an undisclosed internet service provider (ISP) to poison software update mechanisms and distribute malware to target systems. The group exploited insecure HTTP update channels that lacked proper digital signature validation, enabling them to inject malicious payloads into automatic software updates for Windows and macOS devices. This method allowed the attackers to intercept and modify DNS requests, redirecting them to their command-and-control (C2) servers without requiring user interaction. Evasive Panda’s malware arsenal includes various sophisticated tools designed for extensive cyber espionage activities. These include the MgBot malware, a long-standing tool used by the group that has been observed in various campaigns, including targeting Tibetan users and international non-governmental organizations (NGOs) in mainland China. These attacks often involved supply chain compromises or adversary-in-the-middle (AITM) tactics, further underscoring the group’s capability and sophistication. Evasive Panda also uses MACMA, their macOS-specific malware strain. The group has also deployed malicious Google Chrome extensions, such as ReloadText, to steal browser cookies and mail data. Cybersecurity firm Volexity has worked with an affected ISP to identify and disable key traffic-routing devices, effectively stopping the DNS poisoning. However, the group’s persistence and adaptability continue to pose significant challenges to cybersecurity defenses. Evasive Panda’s activities highlight the importance of securing software update mechanisms and validating digital signatures to prevent similar attacks. The group’s ability to leverage sophisticated techniques and a diverse malware toolkit makes them a formidable adversary in the realm of cyber espionage. CTIX analysts will continue to stay vigilant of emerging threat actors and adversarial activities that pose serious risks.