LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1034: Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.[1][2][3][4]

EnterpriseG1034GroupObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G1034: Daggerfly describes [Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at least 2012. [Daggerfly](https://attack.mitre.org/groups/G1034) has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. [Daggerfly](https://attack.mitre.org/groups/G1034) is associated with exclusive use of [MgBot](https://attack.mitre.org/software/S1146) malware and is noted for several potential supply chain infection campaigns.(Citation: Symantec D...

Executive priority

G1034: Daggerfly is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G1034: Daggerfly by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G1034: Daggerfly appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1003.002Security Account ManagerSub-technique

Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.[1]

EnterpriseT1587.002Code Signing CertificatesSub-technique

Daggerfly created code signing certificates to sign malicious macOS files.[4]

EnterpriseT1053.005Scheduled TaskSub-technique

Daggerfly has attempted to use scheduled tasks for persistence in victim environments.[4]

EnterpriseT1071.001Web ProtocolsSub-technique

Daggerfly uses HTTP for command and control communication.[4]

EnterpriseT1059.001PowerShellSub-technique

Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.[1]

EnterpriseT1036.003Rename Legitimate UtilitiesSub-technique

Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.[1]

EnterpriseT1204.001Malicious LinkSub-technique

Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.[4]

EnterpriseT1105Ingress Tool Transfer

Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.[1]

EnterpriseT1082System Information Discovery

Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.[4]

EnterpriseT1195.002Compromise Software Supply ChainSub-technique

Daggerfly is associated with several supply chain compromises using malicious updates to compromise victims.[2][4]

EnterpriseT1574.001DLLSub-technique

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems.[1] Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.[4]

EnterpriseT1218.011Rundll32Sub-technique

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.[1]

EnterpriseT1584.004ServerSub-technique

Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.[4]

EnterpriseT1136.001Local AccountSub-technique

Daggerfly created a local account on victim machines to maintain access.[1]

EnterpriseT1553.002Code SigningSub-technique

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.[4]

EnterpriseT1012Query Registry

Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.[1]

EnterpriseT1189Drive-by Compromise

Daggerfly has used strategic website compromise for initial access against victims.[4]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S1146: MgBot

MgBot is a modular malware framework exclusively associated with Daggerfly operations since at least 2012. MgBot was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.[1][2][3]

Windows
MalwareEnterprise

S1016: MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]

macOS
ToolEnterprise

S0075: Reg

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. [1]

Utilities such as Reg are known to be used by persistent threats. [2]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · MalwareS0013: PlugXEnterpriseuses · TechniqueT1587.002: Code Signing CertificatesEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · MalwareS1146: MgBotEnterpriseuses · ToolS0190: BITSAdminEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · MalwareS1016: MacMaEnterpriseuses · MalwareS1147: NightdoorEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1036.003: Rename Legitimate UtilitiesEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · ToolS0075: RegEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1195.002: Compromise Software Supply ChainEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1584.004: ServerEnterpriseuses · TechniqueT1136.001: Local AccountEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
1.0
Created
Modified
Raw hash
44e9601e5cecd688...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.21.0Current bundle44e9601e5cec…
19.11.0Older bundle9597b0d12423…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Symantec Daggerfly 2023

    Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.

    Open source URL
  2. [2]
    ESET EvasivePanda 2023

    Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.

    Open source URL
  3. [3]
    Symantec Daggerfly 2024

    Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.

    Open source URL
  4. [4]
    ESET EvasivePanda 2024

    Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.

    Open source URL
  5. [5]
    BRONZE HIGHLAND

    (Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2024)

  6. [6]
    Evasive Panda

    (Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2024)

  7. [7]
    mitre-attackG1034
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use