ESET researchers have discovered a network implant used by the China-aligned PlushDaemon APT group to perform adversary-in-the-middle attacks.

Follow us on Bluesky, Twitter (X) and Facebook at @Hackread

ESET researchers uncover a supply-chain attack against a VPN provider in South Korea by a new China-aligned APT group we have named PlushDaemon.

has been active since at least 2019 read more about PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack

A unique take on the software update gambit has allowed "PlushDaemon" to evade attention as it mostly targets Chinese organizations.

l gruppo, impegnato in operazioni di cyberspionaggio, ha condotto un attacco alla supply chain di uno sviluppatore di VPN sudcoreano, sostituendo l'installer legittimo con uno contenente la backdoor SlowStepper, utilizzata esclusivamente da PlushDaemon

PlushDaemon hijacks software updates using EdgeStepper to redirect DNS traffic and deploy SlowStepper malware.

A ESET também identificou um ataque contra um popular serviço de VPN da Coreia do Sul. Saiba tudo sobre este caso.

ESET's new report shed light on PlushDaemon's malicious activities

The Chinese cyberespionage group PlushDaemon has been identified by ESET researchers as utilizing a malware strain named EdgeStepper to intercept software update traffic. This operation aims to compromise supply chains by exploiting the software update processes of targeted organizations. While specific technical details and the full extent of the impact remain undisclosed, the nature of the attack underscores significant risks to supply chain integrity. Supply chain attacks are particularly insidious due to their potential to affect a broad user base through a single compromised source. By intercepting and potentially altering software updates, attackers can distribute malware to all users who install the compromised updates. This method leverages the inherent trust users place in software vendors, making it an effective vector for large-scale infections. The technical implications of this attack are profound. Organizations must ensure the integrity of their software update mechanisms. This includes verifying digital signatures, monitoring network traffic for unusual patterns, and employing endpoint detection and response (EDR) solutions to detect and mitigate such threats. The involvement of a state-sponsored group like PlushDaemon suggests a high level of sophistication and targeting, necessitating advanced defensive measures. From a broader cybersecurity perspective, this incident highlights the critical need for robust supply chain security. Vendors must implement stringent security measures to protect their update mechanisms from compromise. Organizations should also enhance their threat intelligence capabilities to stay abreast of emerging threats and respond effectively. In conclusion, the PlushDaemon group's use of EdgeStepper malware to intercept software updates represents a significant threat to supply chain security. Organizations must adopt a multi-layered defense strategy to detect, prevent, and respond to such sophisticated attacks.

PlushDaemon APT targets South Korean VPN with SlowStepper backdoor. Multistage DNS C&C protocol aids espionage.

A previously undocumented China-aligned advanced persistent threat (APT) group named PlushDaemon has been linked to a supply chain attack targeting a South Korean virtual private network (VPN) provider in 2023, according to new findings from ESET. "The attackers replaced the legitimate installer with one that also deployed the group's signature implant that we have named SlowStepper – a

資安業者ESET揭露韓國VPN服務業者IPany遭遇供應鏈攻擊的事故，中國駭客組織PlushDaemon於安裝程式加入惡意程式碼，導致部分使用者下載後電腦被植入名為SlowStepper的後門程式

South Korean VPN provider IPany experienced a supply chain attack by the PlushDaemon hacking group, which compromised its VPN installer and deployed malware affecting customer systems.