South Korea
KOR
PlushDaemon compromises IPany installer in software supply-chain attack
ESET found that attackers replaced IPany's legitimate Windows VPN installer with a trojanized installer delivering the SlowStepper backdoor. Telemetry showed installations inside a South Korean semiconductor company and software-development company, with earlier infected victims in Japan and China; the malicious installer was removed after ESET notified the provider in May 2024.
73
Estimated severity
73 / 100
90
Source reliability
90 / 100
Approximate Date
2025-01-22
Targeted Company
IPANY
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
No information
Geographic Impact
Country Targeted Company
Other Affected Countries
China
CHN
Japan
JPN
Target country
South Korea
Affected countries
ChinaJapanSouth Korea
Impacted regions
No information
Operational Impact
Duration
No information
Financial impact (USD M)
No information
Impact types
Supply chain data integrity impact
Affected sectors
ManufacturingTechnology & IT Services
Affected departments
Information Technology
Attack Profile
Attack types
BackdoorMalwareSoftware supply chain compromise
Attributed threat actors
PLUSHDAEMON
Sources
Incident Sources
eset.comhttps://www.eset.com/us/about/newsroom/press-releases/eset-discovers-new-china-aligned-apt-group-plushdaemon-and-its-supply-chain-attack-on-south-korean-vpn-service/bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/ipany-vpn-breached-in-supply-chain-attack-to-push-custom-malware/ics-cert.kaspersky.comhttps://ics-cert.kaspersky.com/publications/reports/2025/06/19/apt-and-financial-attackson-industrial-organizations-in-q1-2025/