SecuriTricks - software update hijacking

Network devices compromised for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

apt

espionage

china

adversary-in-the-middle

dns hijacking

slowstepper

software update hijacking

Published: November 19, 2025

Downloadable IOCs: 4

PlushDaemon compromises network devices for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …

apt

espionage

china

adversary-in-the-middle

dns hijacking

slowstepper

software update hijacking

Published: November 19, 2025

Downloadable IOCs: 7

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The at…

china

lateral movement

adversary-in-the-middle

2025-04-30

software update hijacking

Published: May 9, 2025

Downloadable IOCs: 8

Tag: software update hijacking

Attack reports

Network devices compromised for adversary-in-the-middle attacks

PlushDaemon compromises network devices for adversary-in-the-middle attacks

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks