South Korea
KOR
PlushDaemon compromises IPany installer in software supply-chain attack
ESET found that attackers replaced IPany's legitimate Windows VPN installer with a trojanized installer delivering the SlowStepper backdoor. Telemetry showed installations inside a South Korean semiconductor company and software-development company, with earlier infected victims in Japan and China; the malicious installer was removed after ESET notified the provider in May 2024.
73
Estimated severity
73 / 100
90
Source reliability
90 / 100
Approximate Date
22/01/2025
Targeted Company
IPANY
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
No information
Geographic Impact
Country Targeted Company
Other Affected Countries
Japan
JPN
China
CHN
Target country
South Korea
Affected countries
South KoreaJapanChina
Impacted regions
No information
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Supply chain data integrity impact
Affected sectors
Technology & IT ServicesManufacturing
Affected departments
Information Technology
Attack Profile
Attack types
Software supply chain compromiseMalwareBackdoor
Attributed threat actors
PLUSHDAEMON
Sources
Incident Sources
eset.comhttps://www.eset.com/us/about/newsroom/press-releases/eset-discovers-new-china-aligned-apt-group-plushdaemon-and-its-supply-chain-attack-on-south-korean-vpn-service/bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/ipany-vpn-breached-in-supply-chain-attack-to-push-custom-malware/ics-cert.kaspersky.comhttps://ics-cert.kaspersky.com/publications/reports/2025/06/19/apt-and-financial-attackson-industrial-organizations-in-q1-2025/