Loading story…
A China-aligned threat group known as PlushDaemon has been conducting sophisticated supply chain attacks by compromising network devices, particularly routers, to hijack software update mechanisms. Researchers from ESET discovered that the group deploys a custom implant called EdgeStepper on compromised devices, which intercepts and redirects DNS queries related to software updates to attacker-controlled infrastructure. This redirection enables PlushDaemon to deliver malicious payloads, including the downloaders LittleDaemon and DaemonicLogistics, which ultimately install the SlowStepper backdoor toolkit for cyberespionage. The campaign has targeted a wide range of organizations, including universities, electronics manufacturers, and automotive sector companies across the United States, Taiwan, Hong Kong, South Korea, New Zealand, and mainland China.
The attackers gain initial access by exploiting known vulnerabilities or weak administrative credentials on network devices. Once EdgeStepper is installed, it reroutes legitimate update traffic, allowing the attackers to deliver trojanized software updates and establish persistent access. The SlowStepper backdoor provides extensive espionage capabilities, enabling the collection of sensitive information from compromised systems. PlushDaemon has a history of leveraging supply chain attacks and has previously targeted users of the South Korean VPN product IPany. The ongoing campaign highlights the increasing use of adversary-in-the-middle techniques by China-affiliated APT groups to compromise global targets through trusted software update channels.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
On November 19, 2025, ESET published research describing PlushDaemon's use of the previously undocumented Go-based EdgeStepper implant to hijack DNS traffic on compromised network devices. The report detailed how the group redirected software update requests to attacker-controlled infrastructure to deliver LittleDaemon, DaemonicLogistics, and the SlowStepper backdoor.
Since 2019, PlushDaemon has used compromised routers and other edge devices to redirect DNS requests for legitimate software update domains to attacker-controlled infrastructure. Initial access to the network gear was achieved through known vulnerabilities or weak administrator passwords.
ESET assessed that the China-aligned threat actor PlushDaemon has been active since at least 2018, targeting organizations in Asia-Pacific and the United States. Victims included universities and manufacturing firms across countries such as the U.S., Taiwan, China, Hong Kong, New Zealand, and Cambodia.
Among the identified victims, PlushDaemon compromised a Japanese automotive manufacturing plant in Cambodia as part of its espionage activity. The intrusion was part of the broader campaign targeting organizations through hijacked update traffic.
ESET previously linked PlushDaemon to a supply-chain attack involving South Korean VPN provider IPany that delivered the SlowStepper implant. This earlier case connected the group to abuse of trusted software distribution channels.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
7 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcewelivesecurity.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026