A cyberespionage campaign using the Monlam Festival to target Tibetans in several countries and territories has been revealed. Attackers compromised the website of the organizer of the festival, which takes place in India, adding malicious code to create a watering-hole attack
ESET, a global European cybersecurity market leader, has uncovered a cyberespionage campaign that has targeted Tibetans since September 2023 through a targeted watering hole and supply chain breach for the distribution of trojanized installers of Tibetan language translation software. The attackers aimed to deploy malicious downloaders for both Windows and macOS to compromise website visitors with MgBot and an as-yet undocumented backdoor; ESET called it Nightdoor. The campaign by the China-aligned APT Evasive Panda group used the Monlam Festival, a religious gathering, to target Tibetans in several countries and territories. The affected networks were located in India, Taiwan, Hong Kong, Australia and the United States.
ESET discovered the cyberespionage operation in January 2024. The website that was hacked and used as a watering hole belongs to the Kagyu International Monlam Trust, an India-based organization that promotes Tibetan Buddhism internationally. The attack may have been launched to exploit international interest in the Kagyu Monlam Festival held every January in the city of Bodhgaya, India. The Georgia Institute of Technology (also known as Georgia Tech) network in the US is among the organizations identified among the targeted IP addresses. In the past, the university was mentioned in relation to the influence of the Chinese Communist Party on educational institutions in the United States.
In September 2023, attackers compromised the website of an India-based company that develops Tibetan language translation software. The attackers installed several Trojan-infected applications that distribute a malicious downloader for Windows or macOS.
Additionally, the attackers exploited the same website and a Tibetan news website called Tibetpost to host payloads acquired from the malicious downloads, including two backdoors for Windows and an unknown number of payloads for macOS.
“The attackers deployed several downloaders, droppers and backdoors, including MgBot – used exclusively by Evasive Panda – and Nightdoor, the latest major addition to the group's toolkit, which was used to reach several networks in East Asia,” explains Anh Ho, the ESET researcher who discovered the attack. "The Nightdoor backdoor, used in the supply-chain attack, is a recent addition to the Evasive Panda toolset. The first version of Nightdoor we spotted dates back to 2020, when Evasive Panda installed it on the computer of a high-profile target in Vietnam. We requested the removal of the Google account associated with the authorization token," adds Ho.
ESET attributes this campaign to the APT Evasive Panda group, based on the malware used: MgBot and Nightdoor. Over the past two years, the two backdoors were employed together in an unrelated attack against a religious organization in Taiwan, which also shared the same Command & Control server.
Evasive Panda (also known as BRONZE HIGHLAND or Daggerfly) is a China-aligned APT group that has been active since at least 2012. ESET Research observed the group conducting cyberespionage operations against entities in mainland China, Hong Kong, Macau, and Nigeria. Affected government organizations have been identified in Southeast and East Asia, particularly in China, Macau, Myanmar, the Philippines, Taiwan and Vietnam. According to official reports, the group also targeted unnamed individuals in Hong Kong, India and Malaysia.
The group uses its own custom malware framework with a modular architecture that allows its backdoor, known as MgBot, to acquire elements to spy on victims and enhance its capabilities. Since 2020, ESET has also observed that Evasive Panda is able to deploy its backdoors via adversary-in-the-middle attacks that hijack legitimate software updates.
For more technical information on the Evasive Panda group's latest malicious campaign, see the blog post “Evasive Panda leverages Monlam Festival to target Tibetans on WeLiveSecurity.com.
