BRONZE HIGHLAND has been observed using spearphishing as an initial infection vector to deploy the MgBot remote access trojan against targets in Hong Kong. Third party reporting suggests the threat group also targets India, Malaysia and Taiwan and leverages Cobalt Strike and KsRemote Android Rat. CTU researchers assess with moderate confidence that BRONZE HIGHLAND operates on behalf of China and has a remit covering espionage against domestic human rights and pro-democracy advocates and nations neighbouring China
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Evasive Panda |
| OSINT | Daggerfly |
Victim countries: Hong Kong, Malaysia, India, Taiwan, Macao, Nigeria
Top 29 by how many reports mention them.
Every report in the Global Intel Library that names BRONZE HIGHLAND, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to BRONZE HIGHLAND. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.