Chinese Cyberspies Target South Korean VPN in Supply Chain Attack

ESET researchers discovered a supply-chain compromise by a China-aligned APT named PlushDaemon that implanted a 'lite' variant of its SlowStepper backdoor into the Windows NSIS installer for South Korean VPN vendor IPany; the backdoor uses DNS-based multistage C2 and modular espionage tools (audio/video capture, data collection), infected victims in multiple countries (including South Korea, Japan, China), and ESET published IoCs and samples after notifying the vendor.