APT / THREAT GROUP

LittleDaemon

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to ESET Research, LittleDaemon is the first stage deployed on the victim’s machine through hijacked updates. It was observed in both DLL and executable versions, both of them 32-bit PEs. The main purpose of LittleDaemon is to communicate with the hijacking node to obtain the downloader that we call DaemonicLogistics. LittleDaemon does not establish persistence.

Threat Analysis

LittleDaemon is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-network-devices-for-adversary-in-the-middle-attacks/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

LittleDaemonelf.little_daemon

External Intelligence

Malpedia: elf.little_daemon

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search LittleDaemon