DaemonicLogistics

DaemonicLogistics is a malware toolset associated with the Chinese espionage cluster PlushDaemon. It has been linked through distinctive development artifacts and loader behavior to espionage activity attributed to a China-aligned operator. The tooling includes a low-detection DLL backdoor and loader components designed for stealthy in-memory execution. Observed DaemonicLogistics samples masquerade as legitimate software while avoiding straightforward static detection. They resolve native APIs from ntdll through obfuscated strings and use LdrGetProcedureAddress rather than higher-level Win32 API resolution, a technique consistent with defense evasion and reduced exposure to userland security hooks. The malware reads an external encrypted payload, decrypts it, and executes it through a custom in-memory PE loader. Execution involves writing multiple components into memory and launching them via a new thread, reflecting process injection and post-exploitation tradecraft. The tooling has been associated with PlushDaemon through shared development-path conventions and a distinctive fake-GIF payload format. PlushDaemon has been documented as a Chinese espionage actor, and DaemonicLogistics appears to function as part of that broader intrusion ecosystem. Reporting on the cluster has also linked it to compromises of network devices for adversary-in-the-middle operations, indicating a wider espionage capability set beyond endpoint malware alone.