Storm Bamboo Compromises ISP to Abuse Insecure Software Update Mechanisms
Summary: Volexity investigated mid-2023 incidents in which StormBamboo (aka Evasive Panda) poisoned DNS responses at an ISP level to redirect automatic software update requests, delivering malware including MACMA and POCOSTICK to macOS and Windows systems. The attacker altered DNS answers for domains tied to update mechanisms using HTTP and lacking installer signature validation, resolving them to a server in Hong Kong at 103.96.130[.]107; the poisoning stopped when the ISP rebooted and took network components offline.
Key Takeaway: The compromise sat upstream at the ISP, not in the victim's firewall, so no amount of internal hardening would have caught it - and the payload arrived through the update channel the organization already trusted, with no user interaction required.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026