MalwarePublished 19 Nov 2025Updated 20 Dec 2025

PlushDaemon compromises network devices for adversary-in-the-middle attacks

Source AlienVault OTX General

Description

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper to hijack legitimate updates. EdgeStepper redirects DNS queries to a malicious node, rerouting traffic from legitimate infrastructure to attacker-controlled servers. The group has also exploited web server vulnerabilities and performed a supply-chain attack. PlushDaemon's adversary-in-the-middle technique involves compromising network devices, deploying EdgeStepper, and using it to redirect DNS queries for software updates to malicious nodes. This allows them to serve malicious updates containing the LittleDaemon downloader, which then deploys the SlowStepper implant.

Impact

For European organizations, the PlushDaemon threat poses significant risks to confidentiality, integrity, and availability of critical systems. By compromising network devices, attackers can intercept and manipulate DNS traffic, leading to the delivery of malicious software updates that can install persistent backdoors. This undermines trust in software supply chains and update mechanisms, potentially resulting in data exfiltration, espionage, intellectual property theft, and long-term network compromise. Critical infrastructure sectors such as telecommunications, government agencies, defense contractors, and technology firms are particularly vulnerable. The stealthy nature of the attack and lack of user interaction required increase the likelihood of prolonged undetected presence, amplifying potential damage. Additionally, the use of supply-chain attacks can affect multiple organizations downstream, escalating the scope of impact. European entities relying on network devices from vendors with known vulnerabilities or lacking robust update validation mechanisms face elevated risk. The espionage focus of PlushDaemon aligns with geopolitical tensions involving China, increasing the likelihood of targeted attacks against European entities with strategic or economic importance.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat. First, conduct comprehensive audits of network devices to identify and remediate unauthorized implants or suspicious configurations. Employ network segmentation to limit the exposure of critical infrastructure and isolate update servers. Monitor DNS traffic rigorously for anomalies such as unexpected redirections or queries to suspicious domains like those linked to PlushDaemon. Enforce strict validation of software updates using cryptographic signatures and out-of-band verification to prevent malicious update installation. Apply timely firmware and software patches to network devices and servers, prioritizing those with known vulnerabilities. Implement intrusion detection and prevention systems capable of identifying adversary-in-the-middle behaviors and network implant indicators. Enhance supply-chain security by vetting third-party vendors and monitoring for unusual update patterns. Conduct regular threat hunting exercises focusing on indicators of compromise such as the LittleDaemon downloader and SlowStepper backdoor hashes. Finally, raise awareness among IT and security teams about this specific threat actor’s tactics to improve detection and response capabilities.

Indicators of compromise

Domains 3

wcsset.com
ds20221202.dsc.wcsset.com
test.dsc.wcsset.com

IP addresses 2

47.242.198.250CC=US ASN=AS45102 alibaba (us) technology co. ltd.
8.212.132.120CC=SG ASN=AS45102 alibaba (us) technology co. ltd.

Hashes 8

4c4ae06411c7f254236f0494e71105aeMD5 of 8f569641691ecb3888cd4c11932a5b8e13f04b07
af56f9399e7bc0f8fa737f2ac29e2872MD5 of 2857bc730952682d39f426d185769938e839a125
06177810d61a69f34091cc9689b813740d4c260f
2857bc730952682d39f426d185769938e839a125
69974455d8c13c5d57c1ee91e147ff9aed49aebc
8f569641691ecb3888cd4c11932a5b8e13f04b07
86ec75124c41ce5dfe05adeaf3c889c00f693c94903c22ad682580cae0ce6a94SHA256 of 2857bc730952682d39f426d185769938e839a125
ee6e19fff5c0f92b22245dd8ba5d3b93e664829f04c5bc445f631adc6acc0659SHA256 of 8f569641691ecb3888cd4c11932a5b8e13f04b07

Community reviews

Loading reviews…