PlushDaemon is an advanced persistent threat group that public reporting describes as China-aligned and that carries out long-term cyber espionage. It targets government agencies, defense contractors, research institutions and technology companies. The group relies on spearphishing, custom malware, layered persistence and slow data theft, and it avoids noisy exploits.
What is PlushDaemon?
PlushDaemon is a well-organized advanced persistent threat (APT) group attributed to the People’s Republic of China (PRC). It has conducted long-term cyber espionage against high-value targets in Asia and globally. PlushDaemon works in a quiet, methodical and discreet way. It shows many traits of China’s current approach to cyber espionage. These are low noise, strong operational security, and a focus on data of strategic value to the PRC rather than simple disruption.
PlushDaemon has targeted many companies, including government agencies, defense contractors, research institutions, and technology companies. The data and communications it gets through cyber espionage fit many of China’s current geopolitical and military goals.
This intelligence blog gives an overview of the group. It covers who the group is, why it exists, and its techniques, tactics and procedures. It also explains how the group has adapted. It shows why the group remains a major and lasting threat in the international cyber environment.
Who is behind PlushDaemon and what does it want?
PlushDaemon translates as “Pillowy Monkey,” which captures the identity and motivations of this China-affiliated advanced persistent threat (APT) group. This group mainly spies on behalf of the Chinese government. It uses custom-built malware, frameworks and tools to compromise its targets. Its operations are less publicly documented than those of many better-known China APT groups. Yet its tools, victim patterns and way of working match closely with the Ministry of State Security (MSS) or other departments within the Chinese Intelligence Services.
This group has been linked to the Government of China through an attribution type that points to state-sponsored activity. These actors have been operating since at least 2019. As of 2022, they have been steadily gaining ground through 2022-2025.
ESET, whose research first documented the group’s network device implant, describes PlushDaemon as China-aligned and active since at least 2018. ESET reports that its EdgeStepper implant redirects DNS queries to a malicious DNS server. That server then hijacks software update traffic. It delivers the LittleDaemon and DaemonicLogistics downloaders and the SlowStepper backdoor toolkit (ESET Research). The Record’s coverage of the same research adds that the group earlier targeted users of a South Korean VPN. It did so through a compromised installer (The Record).
- Linked to.
- China, as described in public reporting.
- Purpose.
- Long-term cyber espionage.
- Targets.
- Government, defense contractors, research institutions, technology companies.
- Active since.
- At least 2019.
- Style.
- Quiet and methodical, with strong operational security.
Motivation: PlushDaemon plans cyber espionage that covers political, military and technological collection. This follows from long-term access requirements to sensitive data networks, aligned with country partnerships and national priorities for China. It includes aligning defense cooperation plans and new technology developments with national security interests.
TTPs: Methods, Tools, and Access Plans
PlushDaemon operations are marked by stealth, persistence, and careful targeting, not noisy exploits. Instead, the group prefers to use trusted execution paths, abuse legitimate software, and run multi-staged malware frameworks.
Initial Access
PlushDaemon often gains initial access through:
- Highly targeted spearphishing emails aimed at specific companies or people.
- Lures that have been themed to match government policy, defense cooperation, or technical documentation.
- Malicious attachments/archives that rely on user trust instead of trying to exploit many vulnerabilities.
- The occasional use of compromised websites to host payloads that are used for watering-hole-style delivery.
PlushDaemon phishing content is usually well-written, localized and fits the context. This shows that the group has done thorough reconnaissance on the target.
Execution and Tooling
Once access is gained, PlushDaemon creates custom malware parts to cut the chance of detection. Examples of these parts include:
- Lightweight loaders used to decrypt the malware payload in memory
- Custom built backdoors that allow the attacker to execute commands, manipulate files, and gather system data
- Modular implants which allow the attacker to turn on or off individual capabilities depending on the attacker’s needs
To trigger fewer alerts, attackers often use legitimate system processes to run their code.
Persistence
PlushDaemon maintains long-term access through the use of many methods, including:
- Registry auto-run entries
- Scheduled tasks (with innocent-looking names)
- DLL side-loading (placing malicious DLLs next to legitimate executables)
- Many ways to maintain their presence. If one method is blocked or removed, at least one other way back in remains.
This layered persistence lets the group stay inside the victim’s network for a long time.
Command and Control (C2)
The group’s Command & Control (C2) infrastructure is set up to be as quiet as possible:
- Communication is encrypted over HTTPS
- Compromised servers/rented infrastructure is used for masking their origin.
- The group rotates their domains and IP addresses often.
- They send out low-frequency beacons to blend in with normal network traffic.
C2 traffic often looks just like normal web traffic. This makes it hard to detect on the network.
Defense Evasion
The operational security of PlushDaemon is clearly strong, for several reasons:
- The use of obfuscation and encryption to conceal the payload.
- The use of living-off-the-land techniques that do not leave major artifacts of their use.
- The deliberate timing of actions to prevent triggering anomaly-based monitoring.
These tactics show an advanced operator who places a greater value on long-term success than rapidity of success.
Data Collection and Exfiltration
PlushDaemon targets several types of data for collection:
- Policy documents and internal operational guidelines.
- Research data and design documents.
- Email conversations between high-level personnel.
- Network configurations and access credentials.
PlushDaemon exfiltrates data slowly and methodically. It moves compressed, encrypted data in small pieces to slip past data loss prevention software.
- Initial accessSpearphishing emails and lures, sometimes compromised websites
- ExecutionLoaders decrypt the malware payload in memory
- PersistenceRegistry auto-run entries, scheduled tasks, DLL side-loading
- Command and controlEncrypted HTTPS, rotated domains and IP addresses
- ExfiltrationCompressed, encrypted data sent in small increments
Notable Operations
PlushDaemon chooses not to promote its operations in public. It shows only traits seen from its other actions.
Government and Defense Targeting
In government and defense targeting, intrusions have been found within many government ministries and military-related entities across Asia. These incidents appear to be timed with regional security developments or the setting up of defense cooperation agreements. So the group is believed to run these operations to meet intelligence needs for future policy-making and military planning.
Technology and Research Espionage
The group has targeted technology companies, research establishments & institutes working with technology, advanced manufacturing, and Dual-Use Technology. Having access to the data helps help the advancement of domestic technology and to provide strategic guidance.
Long-Term Network Surveillance
Most groups extract large amounts of data at once. PlushDaemon prefers to gain access quietly and keep watching over time. This yields richer intelligence with less chance of detection.
Recent Developments (2023–2025)
Recent findings have shown that the development of PlushDaemon continues to be improved through its tradecraft.
Better Modularity: As the malware parts grow more modular, operators can adjust what the malware does to match each target’s needs.
Better OPSEC: Infrastructure rotation is now much more disciplined, with less reuse of indicators from previous campaigns.
Cloud Aware: The group’s attempts to degrade cloud service usage are not heavily developed. It is, however, aware of hybrid environments and targets endpoints that bridge the on-premise/cloud divide.
Targeted Effectiveness: Campaigns are small in size compared to the number of campaigns targeting the same individual. However, their targeted nature lets the group collect quality intelligence rather than quantity.
Why does PlushDaemon matter strategically?
PlushDaemon helps serve the Chinese government’s wider intelligence efforts in a multitude of ways.
Political Insight: The ability to access the communications of governments gives one insight into their policy discussions, negotiations plans and alliance-building/dynamics.
Military Advantage: Espionage that targets companies that are closely related to the military can support military capability developments and strategic planning.
Technological Edge: Theft of technical and research data shortens the timeline to develop and helps business/industry become more competitive in key global sectors.
Regional Influence: Continuously monitoring the states around China makes it possible to follow developments and carry out influence operations.
PlushDaemon may not make the kind of headlines that attract attention. Through consistent and reliable actions, however, it supports the Chinese Government’s intelligence collection and use of cyber-espionage capabilities.
Conclusion
PlushDaemon is an example of a disciplined, low-profile Advanced Persistent Threat (APT) that operates mainly in China. It gives high priority to stealth, persistence and targeted intelligence collection. The group’s focus on government, defense and technology companies shows its role in supporting China’s state level strategic goals, and not necessarily short-term gain.
More companies are strengthening their perimeter defenses. Actors such as PlushDaemon show that most risk comes from low-key, highly tailored intrusions. These can evade detection for months or years. Effective defense against such advanced persistent threats (APTs) requires four things:
- Strong identity security
- Full, ongoing threat intelligence
- Up-to-date knowledge of adversary tradecraft
- Ongoing behavioral monitoring
So, it is highly likely that PlushDaemon will remain a relevant and dynamic threat to companies for the foreseeable future.
You can download and review the sheet for all the details!
