FlagThis

← All Threat Actors
Threat Actor Profile

Daggerfly

BRONZE HIGHLAND Evasive Panda G1034
▲ High Threat
DNS Poisoning Espionage Campaign, Toolset Refresh and NGO Targeting, Monlam Festival Campaign
Origin China
Sponsor Chinese Government
Motivation Strategic espionage, political surveillance, and intelligence collection targeting geopolitical opponents and domestic dissidents.

Target Sectors

Government organizations Non-Governmental Organizations (NGOs) Telecommunications providers Civil society and pro-democracy advocates Critical Infrastructure Tibetan and Hong Kong activists

Known TTPs

DNS Poisoning (Adversary-in-the-Middle)
Supply Chain Compromise (trojanized software updates)
DLL Side-loading
Modular Malware Frameworks (MgBot)
Cross-platform targeting (macOS via Macma, Android via KsRemote)
Hybrid Encryption for implant obfuscation
Spearphishing
PowerShell and BITSAdmin for payload retrieval

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD