Chinese APT Group Using DNS Poisoning for Espionage

A state hacking group that’s been linked to Chinese cyberespionage infected an internet service provider to redirect software update connections to an attacker server that downloaded malware, say security researchers.

Security firm Volexity uncovered the campaign, attributing it to a threat group its tracks as StormBamboo. The group, also known as EasivePanda, downloaded Macma backdoor onto victims. The Symantec Threat Hunter Team recently attributed Macma to a group it tracks as Daggerfly, a likely state-backed threat actor that targeted pro-democracy activists in Hong Kong (see: Chinese Cyberespionage Group Expands Malware Arsenal).

Volexity researchers first uncovered the campaign last year. The threat actor penetrated an unidentified ISP to poison domain name responses, specifically software update requests made by applications that don’t validate the digital signatures of installers. Volexity said the threat actor targeted multiple software vendors, but named only one: audio-visual player, streamer and downloader 5KPLayer.

Each time 5KPlayer starts up, it checks for a new version of an open source YouTube video downloader, youtube-dl. “StormBamboo used DNS poisoning to host a modified config file indicating a new update was available. This resulted in the YoutubeDL software downloading an upgrade package from StormBamboo’s server,” Volexity wrote. The “upgrade package” served by the threat actor-controlled server contained the Macma backdoor.

Google first spotted Macma in 2021. Multiple security researchers have noted upgrades to the backdoor since then. Volexity says the newest samples it caught show overlap with other malware it attributes to the same threat actor that it cals “Gimmick.” The company identified Gimmick being used in a late 2021 hacking incident involving a MacBook Pro.

Because the attackers launched the campaign from the ISP level, detecting the attacks remained a challenge initially, with the researchers first assuming that the attackers may have gained the initial access after compromising the victim’s firewall.

“Volexity notified and worked with the ISP, who investigated various key devices providing traffic-routing services on their network. As the ISP rebooted and took various components of the network offline, the DNS poisoning immediately stopped,” the researchers said.