Loading story…
Researchers documented DNS-response poisoning linked to China’s Great Firewall that affects domains whose authoritative DNS traffic traverses Chinese infrastructure, not only .cn domains. DNS queries containing selected keywords, including webproxy.id, may receive rotating forged A records—even for nonexistent names—in place of expected NXDOMAIN or REFUSED responses, consistent with censorship infrastructure injecting or altering DNS replies.
The forged records can create subdomain-takeover-like exposure, including through Fastly domain claiming, and may route users to vulnerable cPanel deployments where attackers can trigger XSS. Organizations operating authoritative nameservers in China are most exposed; moving authoritative DNS outside China and setting Secure and HttpOnly cookie attributes can reduce some session-security impact, though phishing and website-defacement risks remain.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Assetnote demonstrated that poisoned subdomains resolving to Fastly could be abused if an attacker claims an unclaimed target wildcard domain and configures an attacker-controlled origin. Independent researcher Eric Head also provided a technique that searches poisoned subdomains for vulnerable cPanel hosts to produce an XSS condition.
Assetnote reported that DNS queries for domains whose authoritative DNS traffic traverses Chinese infrastructure could receive forged A records when query names contain trigger keywords such as "webproxy.id." The researchers assessed the behavior as network-path manipulation associated with Great Firewall censorship mechanisms, potentially affecting zones across multiple TLDs.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers said China used a network attack system dubbed the **Great Cannon** to divert some unencrypted traffic bound for Baidu services and silently replace legitimate responses with malicious JavaScript, turning foreign visitors’ browsers into bots for distributed denial-of-service attacks. The capability was linked to sustained attacks on **GreatFire.org** and later **GitHub**, marking a shift from domestic censorship toward using China’s Internet infrastructure to project offensive effects beyond its borders. Citizen Lab, the International Computer Science Institute, and the University of California, Berkeley said the system appears distinct from but related to the **Great Firewall**, with evidence visible across multiple Chinese ISPs and consistent with state involvement. Researchers warned the same traffic-injection method could be adapted for broader payload delivery, including browser exploits or malware, while U.S. officials said attackers appeared to have leveraged infrastructure in China against U.S.-hosted sites and urged an investigation. The reports said **HTTPS** is the strongest practical mitigation because unencrypted HTTP traffic can be intercepted and modified in transit.
Jun 29, 2026
Research presented at Black Hat and a Booz Allen report describe China’s **Great Cannon** as an offensive cyber system that hijacked unencrypted HTTP traffic and injected malicious JavaScript into users’ browsers, turning them into temporary bots for distributed denial-of-service attacks. The capability was described as separate from, but colocated with, the **Great Firewall** on China Unicom infrastructure, and was notably used against **GreatFire**-related infrastructure on CloudFront and **GitHub**, where international visitors were silently redirected into flooding selected targets with repeated requests. The reporting places the Great Cannon within a broader pattern of PRC cyber operations used to advance state interests around censorship, sovereignty, and political control. Alongside the GitHub and GreatFire incidents, the broader campaign history cited includes attacks on media outlets, petition platforms, and Hong Kong democracy-related services such as **Telegram**, **LIHKG**, **Apple Daily**, and **PopVote**, using tactics including DDoS, defacements, and data leaks. The sources assess likely Chinese state involvement while noting overlapping roles across entities including the **PLA**, **MSS**, **MPS**, and **CAC**, and they highlight **HTTPS**, **HSTS**, certificate protections, and behavioral monitoring as key defenses against traffic-injection attacks.
Aug 15, 2026
Microsoft has published a cluster of DNS-related security advisories covering **remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass** conditions across Windows DNS Server and third-party DNS components. The newly listed issues include `CVE-2026-33278` for possible arbitrary code execution during **DNSSEC** validation, `CVE-2026-42959` for crashes triggered by malicious DNSSEC content, `CVE-2026-42960` for possible cache poisoning through promiscuous authority-section records, and `CVE-2026-42944` for a heap overflow involving multiple `NSID`, `COOKIE`, and `PADDING` **EDNS** options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (`CVE-2026-41292`), unbounded name compression (`CVE-2026-44390`), and a "packet of death" affecting **DNSCrypt** (`CVE-2026-32792`). The disclosures also reference flaws in widely used DNS software, including a **BIND 9** resolver unbounded resend loop (`CVE-2026-5950`), invalid handling of `CLASS != IN` (`CVE-2026-5946`), and a **CoreDNS** ACL bypass (`CVE-2026-26017`). Earlier Microsoft advisories for Windows DNS Server remote code execution, including `CVE-2021-33754` and `CVE-2021-33746`, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.
Jun 29, 2026