Daggerfly
IntrusionSet · ATTACK:enterprise:G1034
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1034",
"title": "Daggerfly",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1034",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--f3be6240-f68e-47e1-90d2-ad8f3b3bb8a6",
"external_id": "G1034",
"domain": "enterprise",
"created": "2024-07-25T17:13:06.098Z",
"modified": "2026-07-31T18:48:26.166Z",
"version": "1.0",
"aliases": [
"Daggerfly",
"Evasive Panda",
"BRONZE HIGHLAND"
],
"tactics": [
],
"source_references": [
{
"source_name": "Evasive Panda"
},
{
"source_name": "BRONZE HIGHLAND"
},
{
"source_name": "ESET EvasivePanda 2024",
"url": "https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"
},
{
"source_name": "ESET EvasivePanda 2023",
"url": "https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"
},
{
"source_name": "Symantec Daggerfly 2023",
"url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"
},
{
"source_name": "Symantec Daggerfly 2024",
"url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01122760-11f7-4fc9-8500-65ee57a6494f
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12c45410-f606-4f0b-86b9-ee0447447b1f
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1587.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1db7023d-eab0-4ddb-9156-9ac03b5e0db9
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ea32af4-a6e3-4ead-9829-35ffc4c91426
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S1146
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fa88d4c-9597-47bf-bbee-44e34761ae7e
ESET EvasivePanda 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S0190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2140f26b-a8ec-4a7e-9903-7df7ea5a1abb
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26de5bd2-2b58-421f-b1f9-ccf02b2c79ea
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38481000-2a88-4768-98a3-aab3c747a6d6
Symantec Daggerfly 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S1147
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86e15021-d906-4c2e-86cd-f8ecb7e1183b
ESET EvasivePanda 2024 · Symantec Daggerfly 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d80e239-9a55-4d03-abfe-8522a8b29313
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d9f1d6f-2ac8-4346-9810-c0a8582f3e2e
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fd50d9a-0d3e-4433-a2b9-b9e0ae3621f7
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90f3ee94-f732-4718-8e42-bb002f4e2109
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:S0075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b0efae5-8e40-49be-982d-31eb1be4eda3
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b642368c-b543-471a-93f2-40af6ff94cbf
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1195.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c043fd01-53bf-43ec-982d-44359c47d905
ESET EvasivePanda 2024 · ESET EvasivePanda 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1296428-d36e-4ee0-9afc-5761d64cf1e7
ESET EvasivePanda 2024 · Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c32532a7-44bc-40a4-83ae-33903c6f1002
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c75e753a-881a-40db-99d2-f7a7b2183606
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc9ea395-767a-42df-9618-c685478a4a3d
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4f37e3b-69bf-4fe4-8d4e-6899fe1f7c3b
ESET EvasivePanda 2024ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da139c4d-ee2f-4d07-9d0b-fb60bdf0353c
Symantec Daggerfly 2023ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1fe915a-cc33-4aae-8bd2-d60ee0ff110d
ESET EvasivePanda 2024