Loading malware…
NKNShell is a Go-based Windows backdoor associated with Larva-24010, a threat actor targeting South Korean VPN users. It supports remote command execution, system information gathering, file operations, data exfiltration, code injection, and distributed denial-of-service attacks. Its command-and-control communications use both NKN, a blockchain-based peer-to-peer network protocol, and MQTT through public brokers. It also uses anonymous blogging platforms to facilitate malware updates.
NKNShell has been distributed through a trojanized installer hosted on a South Korean VPN provider's website. The installer installs the legitimate VPN software while executing PowerShell scripts that retrieve and deploy additional payloads. The same attack chain distributes MeshAgent and gs-netcat and uses supporting scripts to disable Windows security features and establish persistence through WMI and scheduled tasks. These supporting components enable sustained access alongside NKNShell's remote-control capabilities.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Trojanized VPN Installer Deploys NKNShell Backdoor, Using P2P Blockchain and MQTT Protocols for Covert C2
Using P2P Blockchain and MQTT Protocols for Covert C2
Using P2P Blockchain and MQTT Protocols for Covert C2
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.