Threat intelligence / Malware

MgBot

[MgBot](https://attack.mitre.org/software/S1146) is a modular malware framework exclusively associated with [Daggerfly](https://attack.mitre.org/groups/G1034) operations since at least 2012. [MgBot](https://attack.mitre.org/software/S1146) was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.(Citation: Szappanos MgBot 2014)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MgBot](https://attack.mitre.org/software/S1146) is a modular malware framework exclusively associated with [Daggerfly](https://attack.mitre.org/groups/G1034) operations since at least 2012. [MgBot](https://attack.mitre.org/software/S1146) was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.(Citation: Szappanos MgBot 2014)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)

Labels

malware

18 recorded

Relationships

uses

Group

uses

to Audio Capture

Technique

uses

to Clipboard Data

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

Technique

uses

to Data from Local System

Technique

uses

to Data from Removable Media

Technique

uses

to Domain Account

Technique

uses

to Domain Trust Discovery

Technique

uses

Technique

uses

to Local Account

Technique

uses

to Network Service Discovery

Technique

uses

to OS Credential Dumping

Technique

uses

to Process Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Owner/User Discovery

Technique

4 external

References

mitre-attack

S1146

ESET EvasivePanda 2023

https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/

Szappanos MgBot 2014

https://www.virusbulletin.com/virusbulletin/2014/02/needle-haystack

Symantec Daggerfly 2024

https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset