PlushDaemon Strikes Again: Global Cyber Espionage with a Side of DNS Mischief
PlushDaemon, a China-aligned hacking group, has been deploying a new network implant to execute adversary-in-the-middle attacks. Known for hijacking legitimate app updates, they even targeted a South Korean VPN company. Their latest tool, EdgeStepper, redirects DNS traffic, enabling malicious software updates and global cyber espionage.
Hot Take:
Looks like the PlushDaemon hacking group is moving up in the world—or should I say down the rabbit hole of cyber espionage? With their new AitM tool, they’re playing DNS traffic like a DJ at a cyber disco, remixing legitimate updates into malicious beats. Maybe they should consider a career switch to electronic music production; they seem to have the remix part nailed!
Key Points:
- PlushDaemon, active since 2018, is a China-aligned hacking group known for cyber espionage.
- The group targets organizations globally, including those in Cambodia, South Korea, New Zealand, the US, Taiwan, Hong Kong, and China.
- They recently conducted a supply chain attack on South Korean VPN company IPany.
- Their new AitM tool, EdgeStepper, hijacks DNS traffic to redirect software updates to malicious nodes.
- LittleDaemon and DaemonLogistics are used to deploy a backdoor toolkit for espionage.
Already a member? Log in here