Stormbamboo

StormBamboo, also known as Evasive Panda, Daggerfly, or Bronze Highland, is a threat actor group linked to China and has been operational since at least 2012. The group's primary objective is cyberespionage against entities opposing China's interests, including independence movements such as those in the Tibetan diaspora, religious and academic institutions in Taiwan and Hong Kong, and supporters of democracy in China. This advanced persistent threat (APT) group targets civil society organizations and uses complex methods to deploy malware, focusing on software vendors with insecure update mechanisms. In August, StormBamboo successfully compromised an undisclosed internet service provider (ISP), as reported by Volexity researchers. The threat actor group used this access to poison DNS responses for targeted organizations, effectively manipulating software update mechanisms to deliver malware. During one incident, it was discovered that StormBamboo poisoned DNS requests to deploy malware via an HTTP automatic update mechanism and poison responses for legitimate hostnames that were used as second-stage, command-and-control (C2) servers. The DNS records were poisoned to resolve to an attacker-controlled server in Hong Kong at IP address 103.96.130[.]107. Initially, it was suspected that the victim organization’s firewall may have been compromised. However, further investigation revealed that StormBamboo had actually infiltrated the ISP itself, showcasing its sophisticated tactics and ability to exploit vulnerabilities in cybersecurity infrastructure. This highlights the significant threat posed by StormBamboo and similar APT groups, necessitating heightened vigilance and robust security measures within ISPs and other potential target organizations.