PlushDaemon

PlushDaemon is a China-aligned advanced persistent threat (APT) group engaged in espionage operations and active since at least 2018. Reporting attributes the group as Beijing-aligned and links it to targets in China, Hong Kong, Taiwan, Cambodia, South Korea, New Zealand, and the United States, including organizations and individuals. PlushDaemon is known for adversary-in-the-middle (AitM) operations that hijack legitimate software update traffic. Its primary technique involves compromising network devices such as routers and gateways, then deploying a Go-based network implant called EdgeStepper to redirect DNS queries to attacker-controlled nodes. This allows the group to reroute traffic from legitimate software-update infrastructure and deliver malicious payloads. ESET reporting states PlushDaemon used this technique to hijack updates for software including Sogou Pinyin, and that the same AitM method has also been used for lateral movement inside networks. The group’s malware ecosystem includes EdgeStepper, the SlowStepper backdoor, and the downloaders LittleDaemon and DaemonicLogistics. EdgeStepper is used to intercept update traffic and serve malicious packages; LittleDaemon and DaemonicLogistics are used to deploy SlowStepper on Windows systems. Content also links PlushDaemon to a supply-chain attack targeting a South Korean VPN provider in 2023/2024, and notes the group has also exploited web server vulnerabilities. Known aliases directly provided in the content are limited to PlushDaemon.