LittleDaemon
- First seen
- 2023-01-01 00:00:00
- Malware type
- downloader
- Last IoC activity
- 2026-07-01 19:55:51
- Profile updated
- 2026-07-07 14:24:31
Context
According to ESET Research, LittleDaemon is the first stage deployed on the victim’s machine through hijacked updates. It was observed in both DLL and executable versions, both of them 32-bit PEs. The main purpose of LittleDaemon is to communicate with the hijacking node to obtain the downloader that we call DaemonicLogistics. LittleDaemon does not establish persistence.
Reports & references
- ESET — Plushdaemon Compromises Network Devices For Adversary In The Middle Attacks (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Little Daemon (report)