China's Evasive Panda Attacks ISP to Send Malicious Software Updates

Researchers at Volexity found that the China-linked APT known as Evasive Panda (aka StormBamboo/DaggerFly) compromised an ISP to poison DNS responses and redirect insecure HTTP software update requests to attacker-controlled servers, resulting in installation of backdoors (Macma), MGBot/Pocostick variants, and post-exploitation tooling (including a malicious browser extension) to exfiltrate email and credentials; Volexity provided IOCs and detection rules and coordinated mitigation with the affected ISP.