Chinese APT Infects Routers to Hijack Software Updates

PlushDaemon, a Chinese state-aligned APT, has for years targeted trusted software updates by infecting routers and other edge devices in the path of network traffic. It hijacks update requests, redirects them to PlushDaemon infrastructure, and serves victims malicious substitutes via a custom implant, EdgeStepper, written for MIPS32 processors.

Once on a device, EdgeStepper sits between the user and the intended websites, intercepting DNS queries and steering traffic to PlushDaemon hosts; if a target equipment makes a request from certain Chinese software products, the malware can swap the legitimate IP with a PlushDaemon one, paving the way for a backdoor named SlowStepper. SlowStepper is modular and capable of stealing passwords, local files, browser cookies, WeChat data, and screenshots.

ESET has described the operation as leveraging edge devices to deliver updates, noting that PlushDaemon has been active since at least 2018 and its software update scheme since 2019, with the majority of victims in mainland China or Hong Kong. According to ESET, defenders should prioritise vulnerable devices and credential hygiene to disrupt the attack chain.