PlushDaemon's EdgeStepper: Sophisticated DNS Hijacking Attacks

ESET researchers have uncovered a sophisticated attack chain orchestrated by the threat actor PlushDaemon, which leverages a previously undocumented network implant, EdgeStepper, to conduct adversary-in-the-middle attacks. By compromising network devices and redirecting DNS queries to malicious servers, PlushDaemon intercepts legitimate software updates and replaces them with trojanized versions containing the SlowStepper backdoor. This technique has enabled the threat actor to compromise targets across multiple continents since at least 2018. The core of PlushDaemon’s attack infrastructure centers on EdgeStepper, which operates as a DNS proxy that fundamentally alters network traffic patterns within compromised networks. The tool begins by loading encrypted configuration data, decrypting it using AES CBC, and then redirects all DNS traffic to a malicious DNS node controlled by PlushDaemon operators.