News and Analysis

The previously undocumented APT group, PlushDaemon, carried out a 2023 cyber espionage operation against South Korean VPN software. The threat was detected by ESET, who found the malware-infected installer for the IPany VPN on the developer’s website. The malicious software, SlowStepper, is a feature-rich backdoor designed for extensive surveillance and data collection. Victims included entities across South Korea, China, and Japan. ESET has reported that the incident demonstrates the risk posed by targeted cyber espionage campaigns against critical industries.