The Chinese hacker group StormBamboo, aka Evasive Panda, hacked an Internet provider and began infecting the computers of its subscribers with malware. This discovery was made by cybersecurity experts from the Volexity company while investigating the hacking of the resources of a certain organization.
Image source: Cliff Hang / pixabay.com
Volexity initially speculated that the attacked organization’s firewall had been compromised, but further investigation revealed that the malware was traced “upstream to the ISP level.” The source of the problem turned out to be “DNS poisoning,” an attack in which a hacker manipulates the domain name system and redirects user traffic to malicious resources.
Volexity notified the provider about the problem, and the provider examined the operation of the equipment that routes traffic on the network – the provider rebooted and turned off some network components, after which the symptoms of DNS poisoning stopped. Experts blamed the attack on the Chinese hacker group StormBamboo, also known as Evasive Panda.
Image source: volexity.com
Having intercepted control of the DNS system in the provider’s network, the attackers replaced the resources that user programs access for updates – in particular, the free media player 5KPlayer. When applications tried to receive updates, they received malware packages instead. The StormBamboo hackers have used this attack pattern on several software products that use insecure update mechanisms.
Volexity did not name the Internet provider or the number of computers affected by the attack, but said that we are talking about “multiple incidents” that date back to mid-2023. The victims’ computers ran Windows and macOS, and among the malware were MACMA and MGBot – they allow attackers to remotely take screenshots, intercept keystrokes, and steal files and passwords. The attack on the provider’s resources allegedly used the CATCHDNS malware designed to work in the Linux environment.