China-linked cyberespionage group PlushDaemon used South Korean VPN service to inject malware

Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol.

A China-linked cyberespionage group has reportedly exploited a legitimate VPN service to spread malware and spy on victims' activities. The ESET security research team found the malicious code – alongside the legitimate software – in the Windows installer of IPany, a South Korean VPN provider.

The so-called PlushDaemon APT group is also known to have hijacked legitimate updates of Chinese applications, but this technical-advanced supply-chain attack against a trustworthy Korean VPN firm makes the hacking group "a significant threat to watch for," said ESET experts.