Daggerfly

Names and who uses them

• DaggerflyOur name
• BRONZE HIGHLANDSymantec
• Evasive PandaSymantec

Targets

Sectors: Government, Telecommunications, NGOs and think tanks

Regions: Africa

Known techniques

• T1003.002Security Account Manager
• T1012Query Registry
• T1036.003Rename Legitimate Utilities
• T1053.005Scheduled Task
• T1059.001PowerShell
• T1071.001Web Protocols
• T1082System Information Discovery
• T1105Ingress Tool Transfer
• T1136.001Local Account
• T1189Drive-by Compromise
• T1195.002Compromise Software Supply Chain
• T1204.001Malicious Link
• T1218.011Rundll32
• T1553.002Code Signing
• T1574.001DLL
• T1584.004Server
• T1587.002Code Signing Certificates

Malware and tools used