Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareUsed by 1 actor

SlowStepper

SlowStepper is a custom, modular Windows backdoor used by the China-aligned espionage group PlushDaemon. It is described as the group’s signature implant and is delivered through adversary-in-the-middle software update hijacking operations. In the observed intrusion chain, PlushDaemon compromises network devices such as routers, deploys the EdgeStepper network implant to hijack DNS traffic and redirect legitimate software update requests to attacker-controlled infrastructure, and then delivers the LittleDaemon and DaemonicLogistics downloaders, which install SlowStepper on victim systems. The campaign has included hijacking updates for popular Chinese software such as Sogou Pinyin, and PlushDaemon has also been linked to a supply-chain attack against the South Korean VPN provider IPany that delivered SlowStepper.

SlowStepper is characterized as a feature-rich espionage backdoor with capabilities to gather detailed system information, execute commands, perform extensive file operations, steal local files and documents, collect browser data including cookies and credentials, harvest passwords, capture screenshots, and extract data from messaging applications including WeChat. Reported functionality also includes audio and video capture, Python-based spyware modules, keylogging/keystroke interception, credential collection, and self-uninstallation.

PlushDaemon has been active since at least 2018 and has targeted organizations and individuals in China, Hong Kong, Taiwan, Cambodia, South Korea, New Zealand, and the United States, including universities, electronics and manufacturing companies, and automotive-sector entities. High-confidence indicators and related infrastructure mentioned in the content are primarily associated with the delivery chain rather than SlowStepper itself, including the EdgeStepper-linked domains ds20221202.dsc.wcsset[.]com and test.dsc.wcsset[.]com, and the downloader filename popup_4.2.0.2246.dll used as LittleDaemon.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
PlushDaemon

If one such software update request is found EdgeStepper will redirect it to PlushDaemon's infrastructure, resulting in the download of a trojanized update. The attacks lead to the deployment of SlowStepper.

via the hacker newsthehackernews.com
MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1195Supply Chain CompromiseEvidence3

It was first documented by the Slovak cybersecurity company earlier this January, detailing a supply chain attack aimed at a South Korean virtual private network (VPN) provider named IPany to target a semiconductor company and an unidentified software development company in South Korea with a feature-rich implant dubbed SlowStepper.

Execution

1 technique
T1059Command and Scripting InterpreterEvidence1

The SlowStepper malware enables hackers to collect detailed system information, execute extensive file operations, run commands, and use various Python-based spyware tools that can steal data from the browser, intercept keystrokes, and collect credentials.

Credential Access

4 techniques
T1056.001KeyloggingEvidence1

The SlowStepper malware enables hackers to collect detailed system information, execute extensive file operations, run commands, and use various Python-based spyware tools that can steal data from the browser, intercept keystrokes, and collect credentials.

T1539Steal Web Session CookieEvidence1

The SlowStepper malware enables hackers to collect detailed system information, execute extensive file operations, run commands, and use various Python-based spyware tools that can steal data from the browser...

T1555Credentials from Password StoresEvidence2

The SlowStepper malware enables hackers to collect detailed system information, execute extensive file operations, run commands, and use various Python-based spyware tools that can steal data from the browser, intercept keystrokes, and collect credentials.

T1557Adversary-in-the-MiddleEvidence2

A China-linked threat actor tracked as 'PlushDaemon' is hijacking software update traffic using a new implant called EdgeStepper in cyberespionage operations.

Discovery

2 techniques
T1082System Information DiscoveryEvidence2

SlowStepper supports an extensive set of features to gather system information, files, browser credentials, extract data from a number of messaging apps, and even uninstall itself.

T1083File and Directory DiscoveryEvidence2

SlowStepper supports an extensive set of features to gather system information, files, browser credentials, extract data from a number of messaging apps, and even uninstall itself.

Collection

6 techniques
T1005Data from Local SystemEvidence1

SlowStepper is a feature-rich espionage backdoor with modules for browser data collection, audio/video capture, document theft, and credential harvesting.

T1056.001KeyloggingEvidence1

The SlowStepper malware enables hackers to collect detailed system information, execute extensive file operations, run commands, and use various Python-based spyware tools that can steal data from the browser, intercept keystrokes, and collect credentials.

T1123Audio CaptureEvidence1

SlowStepper is a feature-rich espionage backdoor with modules for browser data collection, audio/video capture, document theft, and credential harvesting.

T1125Video CaptureEvidence1

SlowStepper is a feature-rich espionage backdoor with modules for browser data collection, audio/video capture, document theft, and credential harvesting.

T1213Data from Information RepositoriesEvidence1

SlowStepper supports an extensive set of features to gather system information, files, browser credentials, extract data from a number of messaging apps, and even uninstall itself.

T1557Adversary-in-the-MiddleEvidence2

A China-linked threat actor tracked as 'PlushDaemon' is hijacking software update traffic using a new implant called EdgeStepper in cyberespionage operations.

Command and Control

1 technique
T1105Ingress Tool TransferEvidence3

The payload chain typically begins with LittleDaemon, a downloader posing as a DLL, which checks for the presence of the final payload. If absent, it fetches another component, DaemonicLogistics.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.