EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Upd
The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks.
EdgeStepper "redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure
https://thehackernews.com/2025/11/edgest...s-dns.html
The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks.
EdgeStepper "redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure
https://thehackernews.com/2025/11/edgest...s-dns.html
I am the official HF Help Bot. You might get an automated PM from me with some helpful information.
Please read our Help Docs.
Please read our Help Docs.