EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates

Sophisticated Malware Implant Discovered in Software Updates

A recent discovery has shed light on a sophisticated malware implant, dubbed EdgeStepper, which has been found to hijack software updates to deploy malicious code. This cunning tactic involves rerouting DNS queries to inject malware into unsuspecting users' systems.

How EdgeStepper Works

EdgeStepper operates by intercepting DNS queries, which are used to translate human-readable domain names into IP addresses. By manipulating these queries, the malware can redirect users to fake software update websites, where they are tricked into downloading and installing malicious software.

// Example DNS query manipulation
const dnsQuery = "example.com";
const manipulatedQuery = "example.com.edgestepper.com";

DNS Hijacking

The malware achieves this by hijacking the DNS resolution process, which typically involves a user's device sending a DNS query to a recursive DNS server. The recursive DNS server then forwards the query to a root DNS server, which resolves the domain name to an IP address. EdgeStepper interferes with this process by modifying the DNS query to point to a fake software update website.

# Example DNS hijacking
import dns.resolver

dnsResolver = dns.resolver.Resolver()
dnsResolver.nameservers = ["8.8.8.8"]  # Google's public DNS server

try:
    dnsResolver.resolve("example.com")
except dns.resolver.NoAnswer:
    print("DNS query failed")

Software Update Hijacking

Once the user downloads and installs the malicious software, EdgeStepper can deploy additional malware payloads, potentially leading to further system compromise.

Detection and Prevention

To detect and prevent EdgeStepper, users should be cautious when downloading and installing software updates, and ensure that their systems are running up-to-date antivirus software. Additionally, users should be aware of the DNS queries being sent from their devices and monitor their system's network activity for suspicious behavior.

Conclusion

The discovery of EdgeStepper highlights the need for users to remain vigilant when interacting with software updates and to be aware of the potential risks associated with DNS hijacking. By taking proactive steps to secure their systems and monitor their network activity, users can reduce the risk of falling victim to this sophisticated malware implant.

Source: https://thehackernews.com/2025/11/edgestepper-implant-reroutes-dns.html