PlushDaemon Hackers in China Deploy EdgeStepper to Corrupt Software Updates and ...

Cyberpress • November 20, 2025

Share: View original

China cyberattack EdgeStepper - Researchers have uncovered new details on the China-aligned threat actor PlushDaemon, which has been active.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PlushDaemon Hackers Exploit EdgeStepper Tool for Software Update Hijacking The Chinese hacking group PlushDaemon has been observed using a tool named EdgeStepper to hijack legitimate software updates, redirecting traffic to malicious servers. Active since at least 2018, PlushDaemon targets organizations globally, including the US, South Korea, and New Zealand, employing adversary-in-the-middle techniques to compromise network devices and conduct cyber espionage. 9 sources 28

Extracted Entities

APT Groups (1)

Attack Types (1)

Supply Chain Attack

Countries (1)

Malware (1)