EdgeStepper Implant Hijacks DNS to Deploy SlowStepper Malware

EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates

The threat actor PlushDaemon is utilizing a new Go-based backdoor called EdgeStepper to perform adversary-in-the-middle (AitM) attacks. This implant redirects all DNS queries to attacker-controlled servers, allowing the hijacking of software updates and the deployment of the SlowStepper malware.

Why This Matters

Current network security models often assume DNS resolution is trustworthy, focusing on endpoint protection. This attack demonstrates a critical vulnerability in that assumption, allowing attackers to bypass traditional defenses by compromising edge network devices and manipulating DNS traffic. Successfully hijacking software updates can compromise entire networks, with potential costs reaching millions in remediation and lost productivity.

Key Insights

• PlushDaemon Activity: Active since at least 2018, targeting entities across Asia and the US.
• AitM Poisoning: Increasingly popular technique among China-affiliated APT groups (LuoYu, Evasive Panda, BlackTech, etc.).
• SlowStepper Features: Includes extensive capabilities for data exfiltration, credential theft, and persistence.

Working Example

// Simplified example of DNS query redirection (conceptual)
package main

import (
	"fmt"
	"net"
)

func main() {
	// Attacker-controlled DNS server IP
	attackerIP := net.ParseIP("10.0.0.1")

	// Function to intercept and modify DNS queries
	// (In reality, this would involve packet manipulation at the network level)
	modifyDNSQuery := func(query string) string {
		fmt.Printf("Intercepted DNS query: %s\n", query)
		fmt.Printf("Redirecting to attacker's DNS server: %s\n", attackerIP)
		return attackerIP.String()
	}

	// Example usage:
	originalQuery := "example.com"
	modifiedIP := modifyDNSQuery(originalQuery)

	fmt.Printf("Resolved IP address: %s\n", modifiedIP)
}

Practical Applications

• Use Case: PlushDaemon targets software companies and supply chains to distribute SlowStepper through compromised updates.
• Pitfall: Relying solely on endpoint security without robust DNS monitoring and edge network hardening leaves systems vulnerable to AitM attacks.

References:

• https://thehackernews.com/2025/11/edgestepper-implant-reroutes-dns.html