Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · BRONZE HIGHLAND · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

BRONZE HIGHLAND

  • Evasive Panda
  • Daggerfly

MITRE G1034 ↗

BRONZE HIGHLAND — ATT&CK roseBH

attack rose · 17 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2012-0158, CVE-2018-8174

Analyst brief

misp-galaxy + mitre-attack

BRONZE HIGHLAND has been observed using spearphishing as an initial infection vector to deploy the MgBot remote access trojan against targets in Hong Kong. Third party reporting suggests the threat group also targets India, Malaysia and Taiwan and leverages Cobalt Strike and KsRemote Android Rat. CTU researchers assess with moderate confidence that BRONZE HIGHLAND operates on behalf of China and has a remit covering espionage against domestic human rights and pro-democracy advocates and nations neighbouring China

Observed targets (as stated by the sources)

5 countries · 0 sectors
Hong KongMalaysiaIndiaTaiwanNigeriaAssessed origin: China

assessed origin · Chinaobserved targets · 5

countries · 5

  • Hong Kong
  • Malaysia
  • India
  • Taiwan
  • Nigeria

also stated: Macao

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

17 techniques · 9 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    2 techniques

  3. Execution

    3 techniques

  4. Persistence

    1 technique

  5. Stealth

    3 techniques

  6. Defense impairment

    1 technique

  7. Credential access

    1 technique

  8. Discovery

    2 techniques

  9. Command and control

    2 techniques

select a technique

Arsenal

4 malware · 2 tools
Malware
Malware · 4ATT&CK
PlugXS0013 ↗
MgBotS1146 ↗
MacMaS1016 ↗
NightdoorS1147 ↗
Tools
Tools · 2ATT&CK
BITSAdminS0190 ↗
RegS0075 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs BRONZE HIGHLAND is cited as exploiting

none on KEV
  1. CVE-2012-01582026-10-17
    1. “•Exploit vulnerabilities (CVE-2012-0158) –Archive file –VB script vulnerability (CVE-2018-8174) •Toolsets –MgBot –KsRemoteAndroid Rat –Cobalt Strike Evasive Panda”

      cited as exploiting · source: vb2020.vblocalhost.com ↗ · 2026-10-17

  2. CVE-2018-81742026-10-17
    1. “–VB script vulnerability (CVE-2018-8174) •Toolsets –MgBot –KsRemoteAndroid Rat –Cobalt Strike Evasive Panda”

      cited as exploiting · source: vb2020.vblocalhost.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

8 sources
  1. 1.blog.malwarebytes.com/threat-analysis/2020/07/chinese-apt-group-targets-indi…
  2. 2.vb2020.vblocalhost.com/uploads/VB2020-43.pdf
  3. 3.youtube.com/watch?v=LeKi0KfzOow&list=PLffioUnqXWkdzWcZXH-bzPVgcs2R…
  4. 4.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-pop…
  5. 5.attack.mitre.org/groups/G1034
  6. 6.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festiv…
  7. 7.symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot
  8. 8.symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset

Track BRONZE HIGHLAND on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.