EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates

The Hacker News reports that the threat actor PlushDaemon has been seen using a previously undocumented Go-based network backdoor called EdgeStepper to carry out adversary-in-the-middle attacks. EdgeStepper redirects all DNS queries to an external malicious hijacking node, effectively rerouting update traffic from legitimate software update infrastructure to attacker-controlled infrastructure, according to ESET security researcher Facundo Muñoz.

The group, active since at least 2018, is described as China-aligned and has targeted entities across the United States, New Zealand, Cambodia, Hong Kong, Taiwan, South Korea and mainland China. The operation begins when PlushDaemon compromises an edge network device such as a router, either through a software flaw or weak credentials, enabling deployment of EdgeStepper.

Internally, the malware combines a Distributor module that resolves the hijacking node’s IP and a Ruler component to configure IP packet filter rules with iptables. The attack hijacks update channels for several Chinese software, including Sogou Pinyin, delivering a malicious DLL named LittleDaemon and a downloader called DaemonicLogistics to fetch SlowStepper backdoors.