DNS poisoning Archives

AppWizard

November 14, 2025

Android Photo Frame App Infects Devices With Malware, Allows Full Remote Takeover

A recent investigation revealed significant security vulnerabilities in Android-powered digital photo frames, particularly those using the Uhale app (version 4.2.0). These vulnerabilities allow preinstalled applications to autonomously download and execute malware, granting remote attackers complete control of the device without user interaction. The malware is sourced from infrastructure linked to China, with domains like dc168888888.com and webtencent.com distributing malicious content. Many antivirus applications inadequately detect these threats. The Uhale app has high-risk vulnerabilities, including insecure HTTPS trust management and insufficient input validation, enabling remote code execution with root access. Brands associated with Uhale include BIGASUO, Canupdog, Euphro, and others. Exploits can lead to data exfiltration, access to private photos, and further attacks within home and enterprise environments. Technical oversights include outdated Android 6 firmware, disabled SELinux, weak cryptographic protections, and lack of authentication for incoming file transfers. Compromised frames can serve as surveillance tools or points for data exfiltration, posing risks to both home and enterprise networks. Users are advised to disconnect affected frames and monitor for unusual behavior.

Winsage

August 6, 2024

China’s Evasive Panda Attacks ISP to Send Malicious Software Updates

A cyberattack attributed to the China-linked APT group Evasive Panda has compromised an Internet service provider (ISP) through DNS poisoning to exploit software vendor update mechanisms. The attackers delivered variants of the Macma backdoor and post-exploitation malware to exfiltrate sensitive data. Volexity researchers identified the attack in mid-2023, noting that the group targeted software with insecure update mechanisms, such as HTTP, which lacked proper validation of digital signatures. The APT redirected DNS records to an attacker-controlled server in Hong Kong (IP address 103.96.130.107) to facilitate these attacks. Evasive Panda has a history of leveraging legitimate software update channels for malicious purposes, including previous attacks targeting individuals in China and Nigeria. The group is characterized as highly skilled and aggressive, employing various malware types across different platforms. Volexity has provided indicators of compromise to help organizations identify potential impacts from this activity.