PlushDaemon

PlushDaemon is identified in the provided content as a China-aligned threat actor associated with espionage operations. The content states that PlushDaemon implants routers and other network devices with malware referred to as EdgeStepper. Reported capabilities of this malware include hijacking DNS, intercepting update traffic, and deploying multi-stage backdoors to support stealthy espionage. The targeting described is focused on routers and network edge devices, indicating an emphasis on network infrastructure compromise rather than endpoint-only intrusion. The content also explicitly links PlushDaemon operations to DNS and web-layer redirection and edge implants, and notes that standard EDR solutions may not adequately cover these attack surfaces. No additional high-confidence indicators of compromise are provided in the source content beyond the malware/tool name EdgeStepper and the described behaviors.