How EdgeStepper turns routers into update hijackers

PlushDaemon turns ordinary network gear into an adversary-in-the-middle engine by reshaping how devices resolve names. Their edge implant, often called EdgeStepper, quietly diverts update traffic and swaps trusted downloads for malware.

This piece unpacks the technique from the router to the Windows host, explains why it keeps working, and lays out concrete ways to detect and disrupt it without breaking critical services.

The attack shape, from DNS nudge to full compromise

At its core, the operation abuses a simple truth: many popular software updaters still trust whatever DNS answer the local network provides. Once a router or similar device is subverted, the implant positions itself between clients and the internet, answers selected queries with attacker-chosen addresses, then feeds the updater malicious instructions over plain HTTP. The result is not a flashy exploit, it is a rerouting trick that turns a “trusted” update into a delivery channel.

Flow of control

1. Compromise a network device reachable by targets, often through weak credentials or unpatched web interfaces.
2. Install an implant that intercepts DNS on the device and relays queries to a malicious resolver.
3. For domains tied to update checks, return the address of a hijacking server, not the vendor’s network.
4. Respond to the updater’s HTTP requests with instructions that point at attacker payloads masquerading as legitimate files.

Example: a Windows input method editor checks ime.sogou.com for an update. The hijacker returns instructions over HTTP and later serves a file named like a harmless dynamic library. The file is not an editor component, it is the first-stage loader that starts the Windows compromise chain.

EdgeStepper mechanics on embedded Linux

EdgeStepper appears as an ELF program compiled for common router chipsets and written in Go. It boots with a small encrypted configuration file found at /etc/bioset.conf. The file decrypts with Advanced Encryption Standard in cipher block chaining mode and uses a GoFrame default string as both key and initialization vector. The decrypted fields point to a domain that resolves to one or more malicious DNS nodes and a local UDP port where the implant will listen.

How DNS interception is achieved

• The implant inserts network address translation rules so that any UDP packet to port 53, the DNS service port, is redirected to its own listener on a different local port.
• It validates that incoming data looks like a Domain Name System message, then forwards it to the designated malicious DNS node.
• The reply from that node is passed back to the original client unchanged, except the attacker has crafted answers for selected domains.

Because the logic runs on the network device, nothing changes on endpoints. Clients keep using the configured resolver, but the path to that resolver now winds through the implant. One practical check that often catches this early, inspect the device for recent iptables rules that redirect UDP 53 to a high local port and accept input on that port. If the rules disappear after a process exit, use a forensic snapshot of the running rules table instead of saved configuration.

Example configuration cue

On a compromised unit, the decrypted configuration may include a domain like ds20221202.dsc.wcsset[.]com and a port such as 1090. Pivoting on that domain in passive DNS or resolving it from a controlled host can reveal the attacker’s DNS nodes used at the time of writing.

The Windows chain: LittleDaemon to DaemonicLogistics to SlowStepper

Once update traffic is hijacked, the endpoint receives and runs a small loader referred to as LittleDaemon, delivered as either a 32-bit executable or a dynamic library with a name consistent with the spoofed vendor. LittleDaemon is transient by design, it checks whether the group’s main backdoor, SlowStepper, already runs, and if not, it fetches the in-memory downloader DaemonicLogistics over HTTP.

Commanding via HTTP status codes

• LittleDaemon reaches out to resources such as /update/updateInfo.bzp on legitimate domains like ime.sogou.com or mobads.baidu.com. Thanks to the DNS diversion, the request lands on the hijacking node, which returns encrypted content that LittleDaemon XOR-decrypts and executes as DaemonicLogistics.
• DaemonicLogistics interprets HTTP status codes as commands. For instance, 200 leads to an immediate SlowStepper download, 207 may first check for a local antimalware process named 360tray.exe, and codes in the low 200s default to the same behavior as 200 when unrecognized. This allows simple server-side control without custom protocols.
• Payload staging uses magic values to gate parsing. One response begins with a header resembling a ZIP signature, which the downloader writes as a benign-looking file such as %PROGRAMDATA%\Tencent\QQUpdateMgr\UpdateFiles\logo.gif. A second response begins with bytes that resemble a GIF image, which triggers a different decryption and drops additional components to paths listed inside the payload.

Operational tip, examine recent HTTP to update endpoints that returns unusual success codes paired with content types that do not match the file names. If TLS is absent and the files later decrypt into executables, treat the path as a likely staging channel.

Defensive implications and how to break the chain

Stopping this adversary-in-the-middle approach is less about catching a spectacular exploit and more about noticing the small bends in expected network behavior. The asymmetry is clear, the attacker controls one choke point, defenders must harden many clients. The right controls narrow that gap.

Network controls

• Pin DNS egress, only permit recursive DNS from sanctioned resolvers, and alert when a network device starts answering DNS locally. This works when the environment enforces egress controls on UDP 53 and monitors for local listeners, it fails if endpoints rely on arbitrary resolvers set by applications.
• Track resolver responses for critical update domains. If the same query yields different answers inside and outside the target segment, investigate immediately. This works when you maintain a known-good resolution baseline, it fails if vendors use content delivery networks with highly variable answers and no allow list.
• Prefer update channels that use Transport Layer Security with certificate pinning on the client. DNS hijack loses its punch when the updater verifies the server certificate against a pinned key. This works when vendors expose stable pins, it fails if the client disables pinning during fallback or trusts corporate interception certificates.

Host controls

• Flag update processes that fetch over plain HTTP, especially when the file type does not match the Content-Type header. This works when host sensors capture header metadata, it fails if only URLs are logged.
• Watch for transient loaders that drop files into vendor-themed directories unrelated to the installed software. A directory named Tencent\QQUpdateMgr on systems without that suite is a useful pivot. This works when software inventory is current, it fails if gold images already include abandoned directories.

Non-obvious contribution: treat the technique as an Update Lane Hijack, a pattern where DNS answers steer only the updater’s traffic to a controlled lane while general browsing remains untouched. This label helps triage anomalies that affect a narrow set of domains and explains why user complaints are rare until the payload activates.

A representative incident, from edge device to beacon

Context: A midsize enterprise uses a mix of consumer routers at small sites, managed centrally but without firmware baselines. Client machines run popular Chinese input editors and several desktop utilities that auto-update.

T+0 (Trigger): An attacker logs in to a branch router with a default admin credential and installs EdgeStepper. The implant adds rules that redirect UDP 53 to a high local port, then forwards queries to an external DNS node controlled by the operator. The rule evades notice because standard DNS lookups still appear to work.

T+4h (Cascade): An endpoint checks ime.sogou.com for updates. The malicious resolver returns the hijacking node’s address. The updater follows HTTP instructions to fetch a file named like a harmless library. Endpoint security allows it because the transfer uses a well known domain and a vendor-looking file name.

T+48h (Cascade): LittleDaemon runs, does not find SlowStepper, and pulls DaemonicLogistics. The hijacking node replies with a status code that bypasses antimalware checks, then returns two payload segments with ZIP and GIF magic values. Components land under a vendor-themed subdirectory, and the backdoor begins periodic web beacons.

Response: The network team notices a spike in DNS responses for a handful of update domains mapping to an unfamiliar hosting provider. They isolate the branch, snapshot the router’s rules, and find the redirect. Restoring firmware removes the implant, but the Windows payload remains until hosts are reimaged.

Lesson: The defense that failed first was credential hygiene on the router. The defense that failed next was allowing cleartext HTTP for update channels. Monitoring for iptables DNS redirects would have provided an early tripwire.

What not to do: the split-brain DNS anti-pattern

Avoid running two policies for DNS, one for users and another quietly exempting “trusted” updaters to use any resolver. The mechanism of failure is simple, the exemption gives the implant a consistent lane to steer without tripping egress controls. Instead, when an application demands direct DNS, proxy it through an internal resolver with query logging and domain allow lists. This works when the proxy sits off the endpoint and cannot be toggled by local admin rights, it fails if applications can still bind directly to UDP 53.

Hunting notes and pivot paths

• On network devices, list NAT rules and search for recent redirects of UDP 53 to a nonstandard local port. Also check for temporary INPUT rules that accept traffic on that port. If configuration backups look clean, read the live kernel tables.
• On endpoints, review HTTP to update domains returning status codes in the low 200s accompanied by content names that imply dynamic libraries or images. Look for immediate follow-on requests to short paths like /update/file2.bdat and persistence of files with benign extensions that later decrypt into binaries.
• In malware triage, strings that include the GoFrame default phrase used as a cipher key, and a file named bioset compiled for MIPS, are strong hints of the same toolchain. This works when symbols and strings survive stripping, it fails if the build process removes or obfuscates them.
• In DNS telemetry, watch for legitimate vendor domains resolving to addresses in hosting providers unrelated to those vendors, especially when only a subset of clients in one segment see those answers.

Prediction, expressed so it can be tested: as vendors migrate even legacy updaters to strict certificate pinning and authenticated metadata, the observed use of HTTP status codes as control signals will decline for this cluster, replaced by either full TLS interception on the edge device or a pivot to compromising vendor-controlled update points. This will not hold if clients frequently disable pinning during fallback or trust enterprise interception certificates by default.

Why this technique persists

Update systems often balance reachability, backward compatibility, and bandwidth costs. That drives three trade offs attackers exploit:

• Plain HTTP for speed and simplicity: Faster and easier to debug, but any on-path manipulator can alter instructions. Works until compliance pushes encrypted updates everywhere.
• Loose domain validation on clients: Accepting whatever DNS says about the vendor’s domain keeps clients flexible behind proxies, but opens a door to diversion. Works until clients enforce pins or signed metadata.
• Unmanaged edge devices: Routers get treated as appliances, not endpoints. Attackers only need to own one to redirect many. Works until firmware baselines and credential policies are enforced.

If even one of these conditions remains true in a segment, Update Lane Hijack stays viable. Close two of the three, and the attacker must change tools or risk noisy failures.