Larva-24010

Larva-24010 is a threat actor observed since at least 2023 targeting users of a South Korean VPN service through a trojanized installer distributed from the provider’s website. The campaign delivers the legitimate VPN software alongside multiple backdoors, including MeshAgent, gs-netcat, and NKNShell, enabling covert remote access and long-term compromise of victim systems. The actor’s intrusion chain uses a malicious installer that performs environment checks and launches PowerShell-based follow-on activity to retrieve and execute additional payloads. Reported post-compromise behavior includes disabling or bypassing security controls, suppressing telemetry, establishing persistence through scheduled tasks and WMI-based mechanisms, and injecting into benign processes for evasion and execution. NKNShell, a Go-based backdoor associated with this activity, supports extensive remote administration functions including system reconnaissance, file operations, command execution, code injection, and data exfiltration. The campaign has also used gs-netcat for remote shell access and MeshAgent for remote management and desktop control. Use of SQLMap has additionally been associated with automated SQL injection activity. The actor’s operations demonstrate emphasis on defense evasion, persistence, post-exploitation control, and theft of sensitive information from compromised hosts. High-confidence targeting in the available reporting is focused on Korean VPN users, indicating a geographically concentrated campaign against users in South Korea.