‘PlushDaemon’ hackers hijack software updates in supply-chain attacks

A China-linked APT called PlushDaemon is conducting supply‑chain style cyber‑espionage by compromising routers (via known vulnerabilities or weak credentials) and installing an ELF implant named EdgeStepper to hijack software-update traffic and deliver a multi-stage Windows payload (LittleDaemon → DaemonicLogistics → SlowStepper). ESET telemetry links these operations to sustained targeting of electronics manufacturers, universities, and other organizations across multiple countries, and the report includes technical details and IOCs for detection and response.