Fast Facts

• A Chinese-linked group, PlushDaemon, has hijacked software updates by infecting routers since at least 2018.
• Their malware, EdgeStepper, reroutes update requests from popular Chinese apps to malicious servers.
• Most victims are Chinese organizations, but targets also include entities in Taiwan, Cambodia, New Zealand, and the US.
• The attack uses outdated router hardware (MIPS32-based) as a launchpad for network compromise.
• Researchers recommend organizations patch router vulnerabilities and secure admin credentials to defend against this threat.

A New Breed of Digital Heist

Imagine your trusted home router not just ferrying data, but quietly rerouting your most sensitive software updates to a hacker’s den. That’s no dystopian fantasy: it’s the reality uncovered in recent years, as Chinese state-aligned hackers have transformed ordinary network devices into covert operatives. PlushDaemon, a threat group largely unknown to the public, has spent over half a decade compromising the very updates that keep critical apps secure.

From SolarWinds to PlushDaemon: The Evolution of Update Attacks

The 2020 SolarWinds breach shocked the world by showing how attackers could poison trusted software updates to infiltrate thousands of organizations. Yet, PlushDaemon’s campaign reveals an even quieter, more insidious method. Rather than targeting software companies directly, PlushDaemon slips through the digital cracks-by compromising routers and other “edge” devices that sit at the border between organizations and the internet.

Once inside, their custom malware, EdgeStepper, intercepts routine requests for software updates from widely used Chinese programs like Sogou Pinyin, Baidu Netdisk, Tencent QQ, and WPS Office. Instead of connecting to legitimate servers, these apps are silently redirected to PlushDaemon’s infrastructure, where malicious downloads await. The final payload, a backdoor called SlowStepper, lets attackers steal files, passwords, browser cookies, and even WeChat data.

Why Target Their Own?

In a twist, most PlushDaemon victims appear to be Chinese organizations-ranging from universities to electronics manufacturers. While some targets exist abroad, the focus on Chinese software suggests the group is hunting for specific domestic information. The reasons remain murky, fueling speculation about internal surveillance or monitoring of dissidents. Most surprising of all: despite operating since at least 2018, PlushDaemon has remained largely undetected, overshadowed by flashier cyber-espionage groups.

Simple Defenses, High Stakes

What makes PlushDaemon’s scheme particularly effective is its simplicity. Exploiting old vulnerabilities and default passwords on routers-devices rarely updated or monitored-it gains a foothold where few defenders look. Security experts stress basic cyber hygiene: patching router firmware and changing admin credentials can be the difference between safety and a silent breach.

WIKICROOK

• APT (Advanced Persistent Threat): An Advanced Persistent Threat (APT) is a long-term, targeted cyberattack by skilled groups, often state-backed, aiming to steal data or disrupt operations.
• Router: A router is a device that connects different networks, like your home Wi-Fi to the internet, directing data and enhancing network security.
• Malware: Il malware è un software dannoso progettato per infiltrarsi, danneggiare o rubare dati da dispositivi informatici senza il consenso dell’utente.
• Backdoor: A backdoor is a hidden way to access a computer or server, bypassing normal security checks, often used by attackers to gain secret control.
• Firmware: Firmware is specialized software stored in hardware devices, managing their core operations and security, and enabling them to function properly.