PlushDaemon APT Targeted South Korean VPN Software

PlushDaemon, a China-linked APT active since 2019, conducted a 2023 supply-chain compromise of the South Korean VPN installer IPany by embedding a feature-rich backdoor called SlowStepper (30+ modules) that enables data exfiltration, audio/video recording, and network reconnaissance; victims included South Korean semiconductor and software firms and individuals in China and Japan, and ESET’s disclosure led to the removal of the malicious installer.