+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: News and Happenings (https://hackforums.net/forumdisplay.php?fid=89)
+---- Thread: EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Upd (/showthread.php?tid=6314742)
EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Upd - Stanley - Nov 29, 2025
EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Upd
The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks.
EdgeStepper "redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure
https://thehackernews.com/2025/11/edgestepper-implant-reroutes-dns.html