Proprietary · · 30 days
IPany VPN installer carried SlowStepper
PlushDaemon replaced IPany's official Windows VPN installer with a trojanized NSIS build. The installer deployed the real VPN and the modular SlowStepper backdoor.
IPany was compromised through its normal download path. ESET found malicious code in an NSIS installer downloaded from the legitimate South Korean VPN provider's website in May 2024. The package installed IPany and a backdoor, so the visible product still worked.
ESET attributed the operation to PlushDaemon, a China-aligned group active since at least 2019. The IPany case was one of its supply-chain paths; the group also hijacked updates for Chinese applications by redirecting traffic toward attacker-controlled servers.
The implant was SlowStepper, a PlushDaemon backdoor with a modular toolkit of more than 30 components. Public ESET summaries describe DNS-based multi-stage C2 and broad data collection from compromised machines.
ESET notified the VPN developer, and the malicious installer was removed from the site. The affected public window remains approximate because the installer was discovered in May 2024 and public reporting did not give exact first-hosted and removal times.
Appendix · Affected releases
- Affected IPany scope covered the NSIS installer available on ipany.co.kr during the May 2024 compromise period.
Indicators
- familySlowStepper
- groupPlushDaemon
- fileIPany VPN NSIS installer
- observableInstaller deployed both the legitimate IPany VPN software and SlowStepper.
- observableESET notified the VPN developer and the malicious installer was removed.
References
Source record: proprietary/ipany/meta.yaml