Threat-actor profile

← Back to main site

Home/ Threat Actors/ PlushDaemon

🇨🇳PlushDaemon

🇨🇳 PlushDaemon is a tracked threat actor in the Clankerusecase corpus. Attributed to CN. Primary motivation: State. We map 14 detection use cases to this actor across 56 MITRE ATT&CK techniques, with 2 threat-intel articles citing them. Active in our corpus from 2025-11-19 to 2025-12-18.

crit 2

View full actor card → All threat actors

14Use cases

2Articles

56Techniques

4IOCs

Known aliases

PlushDaemon

Top techniques

T1027 · Obfuscated Files or Information T1027.013 · Encrypted/Encoded File T1036.005 · Match Legitimate Resource Name or Location

All other tracked techniques

T1016 · System Network Configuration Discovery T1021.002 · SMB/Windows Admin Shares T1027.009 · Embedded Payloads T1027.015 · Compression T1036.008 · Masquerade File Type T1053.005 · Scheduled Task T1055 · Process Injection T1056.001 · Keylogging T1057 · Process Discovery T1059.001 · PowerShell T1059.003 · Windows Command Shell T1070.004 · File Deletion T1071 · Application Layer Protocol T1071.001 · Web Protocols T1071.004 · DNS T1074.001 · Local Data Staging T1082 · System Information Discovery T1083 · File and Directory Discovery T1098.001 · Additional Cloud Credentials T1102.002 · Bidirectional Communication T1105 · Ingress Tool Transfer T1106 · Native API T1125 · Video Capture T1190 · Exploit Public-Facing Application T1195.002 · Compromise Software Supply Chain T1204.002 · Malicious File T1217 · Browser Information Discovery T1218 · System Binary Proxy Execution T1219 · Remote Access Tools T1480 · Execution Guardrails T1518.001 · Security Software Discovery T1528 · Steal Application Access Token T1555.003 · Credentials from Web Browsers T1560 · Archive Collected Data T1562.001 · T1562.001 T1564.003 · Hidden Window T1567.002 · Exfiltration to Cloud Storage T1568.002 · Domain Generation Algorithms T1569.002 · Service Execution T1573 · Encrypted Channel T1573.001 · Symmetric Cryptography T1573.002 · Asymmetric Cryptography T1574.014 · AppDomainManager T1583.001 · Domains T1583.002 · DNS Server T1583.004 · Server T1585.003 · Cloud Accounts T1588.001 · Malware T1608.001 · Upload Malware T1620 · Reflective Code Loading T1622 · Debugger Evasion T1659 · Content Injection T1665 · Hide Infrastructure

Detection use cases (14)

PlushDaemon SlowStepper C2 discovery via non-browser DNS to public resolvers AI · profile SΣDD PlushDaemon EdgeStepper update-hijack: signed updater fetching payload from raw-IP host AI · profile SDD NosyDoor AppDomainManager hijack: UevAppMonitor.exe executing from non-standard path Bespoke NosyDoor persistence: scheduled task 'OneDrive Reporting Task-S-1-5-21-' under Microsoft folder Bespoke NosyDoor dropper file artefacts in C:\Windows\Microsoft.NET\Framework Bespoke Beaconing — periodic outbound to small set of destinations Internal Remote service execution — PsExec / SMB lateral movement Internal OAuth consent / suspicious app grant Internal Scheduled task created with suspicious image / encoded args Internal PowerShell encoded / obfuscated command Internal RMM tool installed by non-IT user — remote-access utility for hands-on-keyboard Internal Article-specific behavioural hunt — LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Ja Internal PlushDaemon EdgeStepper hijacking infrastructure (wcsset.com / 47.242.198.250 / 8.212.132.120) contact Bespoke LittleDaemon / DaemonicLogistics update-hijack URL pattern (popup_4.2.0.2246.dll, /update/updateInfo.bzp, /update/file6.bdat, /update/file2. Bespoke

Threat-intel articles (2)

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan · 2025-12-18

crit PlushDaemon compromises network devices for adversary-in-the-middle attacks · 2025-11-19

Tracked indicators

Domains (2)

ds20221202.dsc.wcsset.co test.dsc.wcsset.com

IP addresses (2)

119.136.153.0 47.242.198.250