A previously undocumented China-aligned advanced persistent threat (APT) group, named PlushDaemon<\/strong>, has been linked to a supply chain attack targeting a South Korean virtual private network (VPN) provider in 2023, according to new findings from ESET.<\/p>\n The attackers replaced the legitimate installer with one that also deployed the group’s signature implant, named SlowStepper<\/strong> \u2013 a feature-rich backdoor with a toolkit of more than 30 components, as stated by ESET researcher Facundo Mu\u00f1oz in a technical report shared with The Hacker News.<\/p>\n PlushDaemon is assessed to be a China-nexus group that has been operational since at least 2019, targeting individuals and entities in China, Taiwan, Hong Kong, South Korea, the United States, and New Zealand.<\/p>\n Central to its operations is a bespoke backdoor called SlowStepper<\/strong>, which is designed to provide a range of functionalities, including:<\/p>\n ESET also identified in the remote code repository several software programs written in Golang that offer reverse proxy and download functionalities.<\/p>\n The numerous components in the PlushDaemon toolset, and its rich version history, show that, while previously unknown, this China-aligned APT group has been operating diligently to develop a wide array of tools, making it a significant threat to watch for.<\/p>\n Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/p>\n\n Advanced Persistent Threat Group Linked to South Korean VPN Attack A previously undocumented China-aligned advanced persistent threat (APT) group, named PlushDaemon, has been linked to a supply chain attack targeting…<\/p>\n","protected":false},"author":19,"featured_media":1841,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-1840","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/01\/eset.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=1840"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1840\/revisions"}],"predecessor-version":[{"id":1842,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/1840\/revisions\/1842"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/1841"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=1840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=1840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=1840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Attack<\/h2>\n
Background on PlushDaemon<\/h2>\n
SlowStepper: A Key Component of PlushDaemon<\/h2>\n
\n
Additional Findings<\/h2>\n
Conclusion<\/h2>\n
Stay Informed<\/h1>\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"