EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates
Summary
The threat actor PlushDaemon has deployed a new Go-based network backdoor called EdgeStepper, which enables adversary-in-the-middle attacks by hijacking DNS queries. This redirection leads to the potential compromise of legitimate software updates, posing a significant risk to affected systems.
Original Article Summary
The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks. EdgeStepper "redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure
Impact
Not specified
In the Wild
Yes
Timeline
Newly disclosed
Remediation
Implement DNS security measures, monitor network traffic for anomalies, and ensure software updates are obtained from verified sources.