Evasive Panda conducted DNS poisoning attacks to deliver MgBot malware through adversary-in-the-middle (AitM) attacks. The campaign used fake software updates for legitimate applications like SohuVA, iQIYI Video, IObit Smart Defrag, and Tencent QQ. The attack chain involves: 1) DNS poisoning to redirect legitimate domains to attacker-controlled servers, 2) Delivery of initial loader through fake updates, 3) First-stage shellcode fetches encrypted second-stage payload disguised as PNG image from dictionary.com via DNS poisoning, 4) Secondary loader (libpython2.4.dll) uses renamed python.exe for DLL sideloading, 5) Payload decrypted from C:\ProgramData\Microsoft\eHome\perf.dat using custom DPAPI and RC5 encryption, 6) Final MgBot backdoor injected into legitimate svchost.exe process. The malware generates unique encrypted payloads per victim and adapts based on Windows version.