PlushDaemon’s Sneaky VPN Hijinks: The Comedic Misadventures of a China-Aligned Hacker Group
PlushDaemon, a previously undocumented China-aligned APT group, has been linked to a supply chain attack on a South Korean VPN provider. This cyber caper involves swapping legitimate installers with SlowStepper, a backdoor boasting over 30 components, transforming software updates into a hacker’s paradise.
Hot Take:
Who needs Netflix when you can enjoy the latest episode of “APT: Cyber Espionage” starring the previously unknown PlushDaemon group? This China-aligned team has put their hacking creativity to work, proving once again that when life gives you lemons, make a Lemonade VPN installer—complete with a side of SlowStepper backdoor. Grab your popcorn and watch as unsuspecting South Korean VPN users become the latest unwitting stars of cyber espionage!
Key Points:
- A new APT group named PlushDaemon, linked to China, has been identified.
- The group targeted a South Korean VPN provider in a supply chain attack.
- The attack utilized a backdoor called SlowStepper with over 30 components.
- PlushDaemon has been active since at least 2019, targeting multiple countries.
- The attack involved hijacking software update channels and exploiting web server vulnerabilities.