Back to today’s briefing

Story perspectives

APT Group Targets South Korean VPN, Data Compromised

1/23/2025

35 6

Summary

Story summary

In 2023, the notorious China-linked APT group PlushDaemon launched a supply chain attack on South Korean VPN provider IPany, stealthily embedding the SlowStepper backdoor in its installer. This insidious malware compromised user data across South Korea, China, and Japan. Thankfully, ESET researchers uncovered the threat and alerted IPany, leading to the swift removal of the malicious software.

History

Historical Context

In 2023, the APT group PlushDaemon executed a supply chain attack on South Korean VPN provider IPany, embedding malware that compromised user data across East Asia. This incident reflects a growing trend in cyber warfare, reminiscent of the 2017 WannaCry ransomware attack, which exploited vulnerabilities to spread rapidly, highlighting the increasing sophistication and global impact of state-sponsored cyber threats.

1 of 2

Story summary

In 2023, the notorious China-linked APT group PlushDaemon launched a supply chain attack on South Korean VPN provider IPany, stealthily embedding the SlowStepper backdoor in its installer. This insidious malware compromised user data across South Korea, China, and Japan. Thankfully, ESET researchers uncovered the threat and alerted IPany, leading to the swift removal of the malicious software.

1 / 2