PlushDaemon Compromises Network Devices for Adversary-in-the-Middle Attacks

Date: 11/22/2025

Severity: Medium

Summary

PlushDaemon is a China-aligned espionage group active since at least 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group uses its custom backdoor SlowStepper and primarily gains initial access by hijacking legitimate software updates through its network implant EdgeStepper, while also exploiting web-server vulnerabilities and conducting a 2023 supply-chain attack. PlushDaemon compromises network devices to perform adversary-in-the-middle attacks using EdgeStepper (internally dns_cheat_v2), which intercepts and forwards DNS traffic to malicious DNS nodes; this enables the attackers to redirect legitimate update requests to attacker-controlled servers, deliver malicious updates, and deploy SlowStepper to support broader espionage operations.

Indicators of Compromise (IOC) List 

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:    

https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-network-devices-for-adversary-in-the-middle-attacks/