Symantec Daggerfly 2023

MgBot includes modules for dumping and capturing credentials from process memory.

Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.

Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.

MgBot includes modules for performing ARP scans of local connected systems.

MgBot includes modules for identifying local users and administrators on victim machines.

Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.

MgBot includes modules for performing HTTP and server service scans.

MgBot includes keylogger payloads focused on the QQ chat application.

MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.

Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.

MgBot includes modules for identifying local administrator accounts on victim systems.

MgBot includes modules for collecting information on Active Directory domain accounts.

Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.

MgBot can capture clipboard data.

MgBot can capture input and output audio streams from infected devices.

Daggerfly created a local account on victim machines to maintain access.

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.

MgBot includes modules for collecting information on local domain users and permissions.

MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.

MgBot includes modules for stealing credentials from various browsers and applications, including Chrome, Opera, Firefox, Foxmail, QQBrowser, FileZilla, and WinSCP.

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems. Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.