Loading story…
Researchers said China used a network attack system dubbed the Great Cannon to divert some unencrypted traffic bound for Baidu services and silently replace legitimate responses with malicious JavaScript, turning foreign visitors’ browsers into bots for distributed denial-of-service attacks. The capability was linked to sustained attacks on GreatFire.org and later GitHub, marking a shift from domestic censorship toward using China’s Internet infrastructure to project offensive effects beyond its borders.
Citizen Lab, the International Computer Science Institute, and the University of California, Berkeley said the system appears distinct from but related to the Great Firewall, with evidence visible across multiple Chinese ISPs and consistent with state involvement. Researchers warned the same traffic-injection method could be adapted for broader payload delivery, including browser exploits or malware, while U.S. officials said attackers appeared to have leveraged infrastructure in China against U.S.-hosted sites and urged an investigation. The reports said HTTPS is the strongest practical mitigation because unencrypted HTTP traffic can be intercepted and modified in transit.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
U.S. officials publicly said the attackers appeared to have used Internet infrastructure located in China to overwhelm U.S.-based websites and called on China to investigate. The statement followed publication of research attributing the attacks to infrastructure under Chinese control.
Citizen Lab, the International Computer Science Institute, and the University of California, Berkeley published findings describing the 'Great Cannon,' a system distinct from but related to the Great Firewall that injects malicious code into unencrypted traffic. They warned the mechanism could be used not only for DDoS attacks but also potentially for exploit or malware delivery.
Attackers redirected a portion of unencrypted traffic destined for Baidu properties and replaced legitimate responses with malicious JavaScript, causing foreign visitors' browsers to flood GitHub. Researchers said the same campaign also targeted GreatFire content hosted on GitHub.
Researchers reported that GreatFire.org was subjected to a weeks-long distributed denial-of-service attack that they said marked an expansion of Chinese censorship tactics beyond simple blocking. The attack leveraged manipulated unencrypted web traffic to conscript outside users' browsers into sending attack traffic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research presented at Black Hat and a Booz Allen report describe China’s **Great Cannon** as an offensive cyber system that hijacked unencrypted HTTP traffic and injected malicious JavaScript into users’ browsers, turning them into temporary bots for distributed denial-of-service attacks. The capability was described as separate from, but colocated with, the **Great Firewall** on China Unicom infrastructure, and was notably used against **GreatFire**-related infrastructure on CloudFront and **GitHub**, where international visitors were silently redirected into flooding selected targets with repeated requests. The reporting places the Great Cannon within a broader pattern of PRC cyber operations used to advance state interests around censorship, sovereignty, and political control. Alongside the GitHub and GreatFire incidents, the broader campaign history cited includes attacks on media outlets, petition platforms, and Hong Kong democracy-related services such as **Telegram**, **LIHKG**, **Apple Daily**, and **PopVote**, using tactics including DDoS, defacements, and data leaks. The sources assess likely Chinese state involvement while noting overlapping roles across entities including the **PLA**, **MSS**, **MPS**, and **CAC**, and they highlight **HTTPS**, **HSTS**, certificate protections, and behavioral monitoring as key defenses against traffic-injection attacks.
Aug 15, 2026
Researchers documented DNS-response poisoning linked to China’s Great Firewall that affects domains whose authoritative DNS traffic traverses Chinese infrastructure, not only `.cn` domains. DNS queries containing selected keywords, including `webproxy.id`, may receive rotating forged A records—even for nonexistent names—in place of expected `NXDOMAIN` or `REFUSED` responses, consistent with censorship infrastructure injecting or altering DNS replies. The forged records can create subdomain-takeover-like exposure, including through Fastly domain claiming, and may route users to vulnerable cPanel deployments where attackers can trigger XSS. Organizations operating authoritative nameservers in China are most exposed; moving authoritative DNS outside China and setting `Secure` and `HttpOnly` cookie attributes can reduce some session-security impact, though phishing and website-defacement risks remain.
Sep 3, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026