---
title: Evasive Panda's Nightdoor Backdoor
description: Evasive Panda was recently observed targeting Tibetans using a combination of strategic web compromise and supply chain attacks to deliver Nightdoor.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Evasive Panda's Nightdoor Backdoor](https://blog.polyswarm.io/evasive-pandas-nightdoor-backdoor)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Mar 22, 2024 6:57:50 PM

**Related Families:** MgBot

## **Executive Summary**

## Evasive Panda was recently observed targeting Tibetans using a combination of strategic web compromise and supply chain attacks to deliver Nightdoor.

**Key Takeaways**

- Evasive Panda was recently observed targeting Tibetans in an espionage campaign. 
- The threat actors used a combination of strategic web compromise of the Monlam Festival website and supply chain attacks on a Tibetan language software company in the campaign.
- The campaign delivered MgBot and another backdoor, dubbed Nightdoor.

**What is Nightdoor?**

### Evasive Panda was recently observed targeting Tibetans using a combination of strategic web compromise and supply chain attacks. The threat actors used Nightdoor backdoor in this espionage campaign, which has been active since at least September 2023. ESET [reported](https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/) on this activity.

The threat actors leveraged the Monlam Festival to target Tibetans, compromising the website of the festival’s organizer, Kagyu International Monlam Trust, and adding malicious code for strategic web compromise and targeted attacks. The malicious script verifies the potential victim’s IP address. If the IP address falls within a targeted range of addresses, the user is shown a fake error message urging them to download a “fix”. The file, of course, is a malicious downloader. Targeted users were identified in India, Taiwan, Hong Kong, Australia, and the US.

Around September 2023, the threat actors also compromised the website of an Indian software development company that produces a Tibetan language translation software. The supply chain compromise was used to deliver trojanized installers of the software. Evasive Panda used the malicious downloaders, targeting both Windows and MacOS systems, to deliver MgBot and Nightdoor.

Nightdoor is a backdoor that was first observed in the wild in 2020. Evasive Panda first used it to target a high-profile entity in Vietnam. Despite being several years old, it is the group’s most recently identified custom tool. Nightdoor uses UDP or the Google Drive API to communicate with the C2. Nightdoor uses the victim’s MAC address as the victim ID and collects information about the victim machine, including but not limited to OS version, MAC address, IP address, CPU name, computer name, username, device driver names, local time, disk drive name, free and total space, file system type, installed applications, and running processes. Nightdoor creates a reverse shell and uses anonymous pipes to manage input and output. It can also obtain file attributes, move and delete files, and self-uninstall. 

**Who is Evasive Panda?**

Evasive Panda, also known as Bronze Highland and Daggerfly, is a China-aligned threat actor group. Evasive Panda has been active since at least 2012 and is known to conduct espionage campaigns against individual targets in China, Hong Kong, Macao, and Nigeria. They have also targeted government entities in Southeast and East Asia, telecommunications entities in Africa, and unspecified entities in Hong Kong, India, and Malaysia. The group is known to use adversary in the middle attacks, hijacking updates of legitimate software to deliver its backdoors. Other Evasive Panda TTPs include use of a custom malware framework with modular architecture and the MgBot and Nightdoor backdoors.

**IOCs**

PolySwarm has multiple samples of Nightdoor.

 

[88b0ee7273a91d92c3570dbc67896e15b53ca118d2b45e49a3489605cc26bf24](https://polyswarm.network/scan/results/file/88b0ee7273a91d92c3570dbc67896e15b53ca118d2b45e49a3489605cc26bf24)

[419311167faeee927763b67ce00dbd4491f18bb0dbac9236621faec9e6422fa9](https://polyswarm.network/scan/results/file/419311167faeee927763b67ce00dbd4491f18bb0dbac9236621faec9e6422fa9)

[3e92f35c3818be05033b9f6716fe4fc30d5a68f6e412422ad7c68c85d4451ae4](https://polyswarm.network/scan/results/file/3e92f35c3818be05033b9f6716fe4fc30d5a68f6e412422ad7c68c85d4451ae4)

[c55dc6adb0f8faa94650d379814c568ca55db3d50f8fb8c5b075a21955f76daf](https://polyswarm.network/scan/results/file/c55dc6adb0f8faa94650d379814c568ca55db3d50f8fb8c5b075a21955f76daf)

[ee6a3331c6b8f3f955def71a6c7c97bf86ddf4ce3e75a63ea4e9cd6e20701024](https://polyswarm.network/scan/results/file/ee6a3331c6b8f3f955def71a6c7c97bf86ddf4ce3e75a63ea4e9cd6e20701024)

[cb7d9feda7d8ebfba93ec428d5a8a4382bf58e5a70e4b51eb1938d2691d5d4a5](https://polyswarm.network/scan/results/file/cb7d9feda7d8ebfba93ec428d5a8a4382bf58e5a70e4b51eb1938d2691d5d4a5)

[2c0cfe2f4f1e7539b4700e1205411ec084cbc574f9e4710ecd4733fbf0f8a7dc](https://polyswarm.network/scan/results/file/2c0cfe2f4f1e7539b4700e1205411ec084cbc574f9e4710ecd4733fbf0f8a7dc)

[174a62201c7e2af67b7ad37bf7935f064a379f169cf257ca16e912a46ecc9841](https://polyswarm.network/scan/results/file/174a62201c7e2af67b7ad37bf7935f064a379f169cf257ca16e912a46ecc9841)

[d9eec27bf827669cf13bfdb7be3fdb0fdf05a26d5b74adecaf2f0a48105ae934](https://polyswarm.network/scan/results/file/d9eec27bf827669cf13bfdb7be3fdb0fdf05a26d5b74adecaf2f0a48105ae934)

 

You can use the following CLI command to search for all Nightdoor samples in our portal:

**$ polyswarm link list -f Nightdoor**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or to subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) *|* [Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

 

[View full post](https://blog.polyswarm.io/evasive-pandas-nightdoor-backdoor)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2024-03-22T18:57:50.245Z",
  "datePublished" : "2024-03-22T18:57:50Z",
  "headline" : "Evasive Panda's Nightdoor Backdoor",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/EVASIVE.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/evasive-pandas-nightdoor-backdoor",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```