Blogs
New Chinese cyberespionage campaign targeted South Korean VPN service
Summary: ESET’s January 2025 research described a compromised Windows installer distributed through South Korean VPN developer IPany’s website. The package installed the genuine VPN application alongside a backdoor called SlowStepper.
ESET attributed the activity to PlushDaemon, a group it assessed as China-aligned. Its researchers noticed the malicious installer in May 2024, notified the developer, and reported that the affected download was removed. Attribution here is ESET’s assessment, not independent confirmation by CNB Telecom.
The researchers described SlowStepper as a modular espionage tool capable of collecting information and loading additional components. The incident illustrates how an apparently legitimate software download can become an entry point without making every user or every VPN product a confirmed victim.
CNB Telecom perspective
Organizations should review software provenance and unexpected behavior after installation, not rely solely on a familiar download website. Where compromise is suspected, incident review should consider exposed accounts and downstream access. This is a historical case study, not a claim that IPany’s current download remains compromised.
Original source
Independently summarized and reviewed by CNB Telecom
Historical report; reviewed October 13, 2026.