Home/Threat Actor/Daggerfly
Threat Actor

Daggerfly

daggerfly · china · active since 2012

Daggerfly (Evasive Panda / Bronze Highland / APT24 / Suckfly / TAG-50 / G0143) is a suspected China-aligned cyber-espionage cluster active since at least 2012 and one of the longest-running publicly-tracked China-aligned clusters in the public record, consolidated under the Daggerfly identity by Symantec's July 2024 seminal disclosure "Daggerfly: Espionage Group Makes Big Update to Toolset" unifying the prior Symantec Suckfly, CrowdStrike Bronze Highland, and ESET Evasive Panda naming streams, distinguished operationally by three defining signatures: (1) sustained dissident-and-ethnic-minority targeting including Tibetan-diaspora communities and the Tibetan government- in-exile, Uyghur-diaspora human-rights organizations, Hong Kong pro-democracy activists and civil society (intensified after the 2019 protests and 2020 National Security Law), Taiwanese government and independence organizations, and Falun Gong.

(2) uncommon cross-platform Windows/macOS/Linux capability with the signature MgBot (Windows) + Macma (macOS, first observed 2021 Hong Kong pro-democracy watering-hole compromises disclosed by Google Threat Analysis Group) + Nightdoor + previously- undocumented ELF Linux backdoor (Symantec July 2024 disclosure) toolkit.

(3) distinctive African telecom operator targeting in Egypt, Ethiopia, Kenya, South Africa, Nigeria, and selected other African countries (consistent with broader PRC strategic interest in African telecommunications infrastructure), and by the operationally consequential ESET April 2023 Evasive Panda Tibetan supply-chain disclosure documenting Daggerfly compromise of a Tencent QQ software update server in mainland China to deliver MgBot implants to Tibetan-diaspora victims using Tencent QQ messaging, demonstrating substantial supply- chain compromise sophistication against ethnic-minority dissident communities.

china confidence: high 19 aliases MITRE ATT&CK G1034 ↗

Profile

Daggerfly (also tracked as Evasive Panda, Bronze Highland, APT24, Suckfly, TAG-50 in Recorded Future taxonomy, and MITRE ATT&CK G0143) is a suspected China-aligned cyber-espionage cluster active since at least 2012, one of the longest-running publicly- tracked China-aligned clusters in the public record. Symantec's seminal July 2024 disclosure "Daggerfly: Espionage Group Makes Big Update to Toolset" explicitly consolidated prior Symantec Suckfly, CrowdStrike Bronze Highland, and ESET Evasive Panda naming streams under the Daggerfly identity, making the cluster's vendor-naming taxonomy substantially clearer than it had been across the prior decade of fragmented tracking. The cluster is widely assessed to operate in alignment with Chinese state intelligence interests, most commonly framed as MSS (Ministry of State Security) tasking. The specific MSS bureau has not been formally established, unlike APT3 (MSS Guangdong / Boyusec), APT10 (MSS Tianjin), APT31 (MSS Hubei), APT41 (MSS / Chengdu 404), and RedFoxtrot (PLA Unit 69010) which carry bureau-or-unit-level formal attribution. Three operational dimensions distinguish Daggerfly from peer publicly-tracked China-aligned clusters: First, dissident-and-ethnic-minority-targeting is the cluster's defining victim signature. Sustained multi-year operations against Tibetan-diaspora communities (notably in Dharamshala India, Nepal, and global diaspora), the Tibetan government-in- exile, Uyghur-diaspora human-rights organizations (US, UK, Germany, France, Canada, Australia), Hong Kong pro-democracy activists and civil-society organizations (intensified after the 2019 Hong Kong protests and 2020 National Security Law), Taiwanese government and independence organizations, religious organizations (Falun Gong), and broader Chinese-diaspora dissident targets. The ethnic-minority-and-dissident focus aligns with longstanding PRC strategic interest in surveillance of these communities and represents one of the most consistent single-victim-category cluster patterns among publicly-tracked operations. Second, cross-platform Windows / macOS / Linux capability is uncommon among publicly-tracked China-aligned clusters at this tier and is a defining modern tradecraft signature. The cluster's toolkit includes MgBot (Windows signature implant, continued across multiple years of evolution), Macma (macOS signature implant first observed in 2021 watering-hole compromises of pro-democracy Hong Kong websites disclosed by Google Threat Analysis Group, subsequently attributed to Daggerfly / Evasive Panda with sustained 2021-2024 evolution), Nightdoor (newer Windows implant), and a previously-undocumented ELF Linux backdoor disclosed in Symantec's July 2024 Daggerfly disclosure. The Linux capability extends the cluster's reach into Linux- server-prevalent environments including African telecommunications infrastructure where Linux is dominant on operator-network equipment. Third, African telecom operator targeting is a distinctive cluster signature. Most publicly-tracked China-aligned clusters focus on East Asian, North American, European, or South Asian victim categories.

Daggerfly's sustained operations against African telecommunications operators in Egypt, Ethiopia, Kenya, South Africa, Nigeria, and selected other African countries reflects broader PRC strategic interest in African telecommunications infrastructure (consistent with Chinese commercial-and-state investment in African telecom networks via Huawei / ZTE infrastructure deployment). The cluster's most operationally consequential publicly-disclosed campaign is ESET's April 2023 Evasive Panda Tibetan supply-chain attack disclosure: documented Daggerfly / Evasive Panda compromise of a Tencent QQ software update server in mainland China to deliver MgBot Windows implants to Tibetan-diaspora victims who use Tencent QQ messaging. The operation demonstrates substantial operational sophistication (sustained access to a major Chinese software publisher's update infrastructure for targeted-victim-only implant delivery, not broad scattershot compromise) and the cluster's continued investment in sophisticated supply-chain compromise capability against ethnic-minority dissident communities. Toolkit centers on MgBot (Windows), Macma (macOS), Nightdoor, and the ELF Linux backdoor as the modern signature implants, with MgmRAT (precursor to MgBot, used in earlier Suckfly / APT24 / Bronze Highland eras) as historical lineage. Stolen valid digital certificates have been a sustained tradecraft signature since the Suckfly era, the cluster has consistently used legitimate-developer certificates stolen via separate compromise to sign implants and defeat code-signing-enforcement controls. A handful of operational notes: First, the cluster's four primary aliases (Daggerfly, Evasive Panda, Bronze Highland, Suckfly / APT24) should be treated as alternative names for the same operational cluster following Symantec's July 2024 consolidating disclosure. Earlier reporting under separate naming should be re-read as Daggerfly activity under different vendor-naming streams. Second, the cluster is operationally distinct from Mustang Panda / Camaro Dragon (already covered as mustang_panda.yaml, MSS-suspected, PlugX-centric, broader victim profile including government and diplomatic targets). The two clusters share the "Panda" CrowdStrike-naming convention but operate different toolkits and target different victim categories. Third, the cluster is operationally distinct from APT41 (already covered as apt41_winnti.yaml, MSS / Chengdu 404, dual espionage- and-financial motivation, ShadowPad / Winnti toolkit). Both operate under suspected MSS tasking but operate against substantially different victim categories with substantially different toolkits. Fourth, formal MSS bureau attribution remains an open analytical question. Treat the MSS-tasking framing as suspected at the bureau level even though the broader China-aligned framing is high-confidence by vendor-research-consensus standards.

Aliases

19
daggerflydagger flydagger_flyevasive pandaevasive_pandaevasivepandabronze highlandbronze_highlandbronzehighlandapt24apt-24apt_24suckflytag-50tag_50tag50g0143atk 233atk233

Notable Campaigns

10
2024-2025Continued Operations (2024-2025)
2024Symantec: Daggerfly, Espionage Group Makes Big Update to Toolset (July 2024)
2023-2024Cross-Platform Windows / macOS / Linux Capability (2023-2024)
2023ESET: Evasive Panda, Tibetan Supply-Chain Attack (April 2023)
2021-2024Macma macOS Backdoor Evolution (2021-2024)
2019-2024Hong Kong Pro-Democracy Targeting (2019-2024)
2018-2024African Telecom Operator Targeting (2018-2024)
2014-2024Sustained Tibetan and Uyghur Diaspora Targeting (2014-2024)
2014-2020APT24 / Bronze Highland Historical Tracking (2014-2020)
2014-2015Symantec: Suckfly, Chinese APT Group Steals Digital Certificates (March 2016)

Attribution & Reporting

Attributed by
Symantec (Broadcom)ESETCrowdStrikeMandiant / FireEyeTrend MicroKaspersky GReATCisco TalosSentinelOneMicrosoftRecorded Future Insikt GroupVolexityCitizen Lab (University of Toronto)Cluster25Cyfirma360 Threat Intelligence CenterQiAnXin Threat Intelligence CenterGroup-IB
Key reporting
reportSymantec: Suckfly, Chinese APT Group Steals Digital Certificates (March 2016), earliest cluster naming
reportSymantec: Suckfly Attacks India (May 2016)
reportMandiant: APT24 Tracking (multiple years)
reportCrowdStrike: Bronze Highland China-Targeted Espionage Tracking (multiple years)
reportESET: Evasive Panda APT Group Delivers Malware via Updates of Popular Chinese Software (April 2023), seminal Tibetan supply-chain disclosure
reportESET: DoNotGo / Evasive Panda Tibetan Supply Chain Continued Tracking (2024)
reportGoogle Threat Analysis Group: Analyzing Watering Hole Campaign Using macOS Exploits (November 2021), Macma disclosure
reportSymantec: Daggerfly, Espionage Group Makes Big Update to Toolset (July 2024), seminal consolidating disclosure with cross-platform ELF Linux backdoor
reportCitizen Lab: Tibetan Community Targeted Digital Threats (August 2014), adjacent context
reportVolexity: Tibetan Diaspora Targeting Tracking (multiple years)
reportRecorded Future Insikt Group: TAG-50 / Evasive Panda Tracking (multiple years)
reportSekoia: Daggerfly Evasive Panda China Tracking (2024)
reportCyfirma: Daggerfly China APT Tracking (2024)
reportCluster25: Daggerfly Operational Profile (2023-2024)
reportMalpedia Actor Profile: Evasive Panda
reportMITRE ATT&CK Group G0143, Daggerfly / Evasive Panda

Operational

State sponsor

Suspected China-aligned cyber-espionage cluster, widely assessed by vendor research consensus (Symantec seminal 2014 Suckfly disclosure, CrowdStrike Bronze Highland tracking, ESET seminal April 2023 Evasive Panda Tibetan supply-chain disclosure, Symantec July 2024 Daggerfly toolkit-refresh disclosure, Mandiant APT24 historical tracking, Trend Micro, Recorded Future, others) to operate in alignment with Chinese state intelligence interests, most commonly framed as MSS (Ministry of State Security) tasking. Whether the cluster operates under a specific MSS bureau (no formal bureau-level attribution has been published, unlike APT3 MSS Guangdong / Boyusec, APT10 MSS Tianjin, APT31 MSS Hubei, APT41 MSS / Chengdu 404) remains analytically open. The cluster is one of the longest-running publicly-tracked China-aligned clusters in the public record, with operational lineage tracing to approximately 2012 under the Suckfly naming, evolving through APT24 / Bronze Highland vendor-naming streams, and consolidating under the modern Evasive Panda (ESET) and Daggerfly (Symantec) names.

No formal government attribution event has been issued. The vendor- consensus China-aligned framing is high-confidence by vendor- research standards but not at the formal-state-prosecution tier of clusters like APT1, APT3, APT10, APT31, APT41, or RedFoxtrot. Symantec's July 2024 Daggerfly disclosure explicitly consolidated the prior Symantec Suckfly, CrowdStrike Bronze Highland, and ESET Evasive Panda naming streams under the Daggerfly identity; treat the four primary aliases (Daggerfly, Evasive Panda, Bronze Highland, Suckfly / APT24) as alternative names for the same cluster.

Motivations
espionage, intelligence_gathering, dissident_surveillance, ethnic_minority_surveillance, religious_minority_surveillance, diaspora_surveillance, geopolitical_collection, economic_espionage, supply_chain_compromise
Sectors
Regions

Detection Blind Spots

60 techniques
Across this actor’s 60 mapped techniques, the share covered by each detection layer. Low bars are where you’d be blind if this actor targeted you.
Behavioral / log (Sigma)56/60 · 93%
Analytics (MITRE CAR)26/60 · 43%
Runtime / container (Falco)8/60 · 13%
File / malware (YARA)0/60 · 0%
Network (Suricata/Snort)14/60 · 23%
Vuln scan (Nuclei)0/60 · 0%

Atomic Test Plan

30 techniques
Runnable Atomic Red Team tests covering this actor’s mapped techniques - validate your detections against this specific adversary. Cross-reference the blind spots above. For authorized lab / purple-team use. Open the full builder

Tools Used

4 mapped
Other tooling / TTPs (curation, not ATT&CK-mapped):
MACMA MACOS BACKDOORMGM RATMGMRATMSHTASIGNED CERTIFICATE ABUSESOFTWARE UPDATE SUPPLY CHAIN ABUSESTOLEN VALID DIGITAL CERTIFICATESSUCKFLY TOOLKIT
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin