MalwareUsed by 5 actors

SoftEther VPN

SoftEther VPN is an open-source VPN software suite that threat actors repeatedly abuse as a legitimate remote-access tool for stealthy communications, persistence, and bypassing network restrictions. The provided reporting describes use of SoftEther VPN clients and SoftEther VPN Bridge by multiple China-linked espionage clusters, including CL-STA-0048, UNC2814, UAT-7237, Flax Typhoon, and GALLIUM/Red Dev 4. Observed tradecraft includes delivery of SoftEther VPN clients configured to connect to attacker-controlled infrastructure; deployment of SoftEther VPN Bridge to create encrypted outbound connections; and installation of renamed binaries for defense evasion and persistence, including conhost.exe in C:\Windows\SysWOW64, oracll.exe, and bridge.exe in System32. In one reported case, attackers created a service named SysBridge to auto-start the renamed SoftEther binary at reboot, and the process established outbound HTTPS connections to an attacker-controlled IP on port 443 to create a covert VPN channel. UAT-7237 reportedly used SoftEther VPN alongside RDP for persistent access to compromised Taiwanese web-hosting infrastructure, with observed SoftEther-related infrastructure spanning roughly September 2022 through December 2024 and Simplified Chinese configured as the preferred display language. Flax Typhoon used a renamed SoftEther executable to maintain covert access after compromising an ArcGIS environment, while Red Dev 4/GALLIUM used SoftEther VPN clients to maintain footholds in telecommunications victims. Across the cited incidents, SoftEther VPN is associated with long-term persistence, covert remote administration, and lateral-enablement in victim environments, especially in telecommunications, government, web infrastructure, and other high-value networks.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Red Dev 4

We will discuss some of the recent techniques we’ve seen Red Dev 4 use to maintain footholds within victim environments, such as the delivery of SoftEther VPN clients configured to connect to threat actor-owned infrastructure.

via trooperstroopers.de

GALLIUM

via trooperstroopers.de

UAT-7237

...deploying the SoftEther VPN software for remote access.

via security weeksecurityweek.com

Flax Typhoon

"We also identified a SoftEther VPN binary placed at C:\Windows\SysWOW64\conhost.exe..."

via checkpoint research blogresearch.checkpoint.com

UNC2814

"...and deployed SoftEther VPN Bridge to create an encrypted outbound connection."

via security affairssecurityaffairs.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

3 techniques

T1583.003Virtual Private ServerEvidence1

Webworm makes use of SoftEther VPN servers that have been seen hosted on Vultr cloud services.

T1588.002ToolEvidence1

Operators have used tools such as Impacket and SoftEther.

T1608.002Upload ToolEvidence1

Webworm staged tools in its GitHub repo for direct download onto compromised systems.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.

T1133External Remote ServicesEvidence7

The attackers then establish persistence using VPNs and other tools disguised as legitimate system processes.

Execution

3 techniques

T1059.003Windows Command ShellEvidence1

The threat actor installs the SoftEther VPN on compromised public-facing servers and uses certutil commands to download and install the SoftEther VPN server.

T1203Exploitation for Client ExecutionEvidence1

The threat actor exploited the MS-SQL server for command execution, which in turn downloaded additional payloads.

T1569.002Service ExecutionEvidence1

The threat actor installs the SoftEther VPN on compromised public-facing servers... With the VPN server installed, the actor can then connect to the victim’s network to conduct their post-exploitation movements.

Persistence

3 techniques

T1078Valid AccountsEvidence1

While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.

T1133External Remote ServicesEvidence7

The attackers then establish persistence using VPNs and other tools disguised as legitimate system processes.

T1543.003Windows ServiceEvidence2

attack cases targeting domestic web servers running SoftEther VPN were identified

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.

T1543.003Windows ServiceEvidence2

attack cases targeting domestic web servers running SoftEther VPN were identified

Stealth

3 techniques

T1036MasqueradingEvidence8

圖六、駭客將 SoftEther VPN 程式偽裝成 svchost.exe

T1036.005Match Legitimate Resource Name or LocationEvidence1

The SoftEther server executable is renamed to either taskllst.exe, tasklist.exe, or tasklist_32.exe for the Windows executable and curl for the Linux executable to make it look like a legitimate file on the installed system.

T1078Valid AccountsEvidence1

While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

UAT-7237 exploits unpatched servers for initial access, then performs rapid reconnaissance using commands like nslookup, systeminfo, and ping before establishing persistence via SoftEther VPN and RDP rather than web shells.

T1210Exploitation of Remote ServicesEvidence1

building VPN servers on compromised public-facing servers to establish access into the private network of victims and performing brute-force attacks to obtain email credentials.

Collection

1 technique

T1560Archive Collected DataEvidence1

For data staging and exfiltration, they frequently compressed findings into password-protected RAR archives.

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

VShell is a backdoor malware developed in the Go programming language... supports protocols such as TCP, HTTP, and UDP for communication with the C&C server

T1090ProxyEvidence5

Cloudflared was used to expose local ports to the outside.

T1090.002External ProxyEvidence2

establish persistent tunneling infrastructure using SoftEther VPN, Yuze, and VNT, all disguised as VMware executables or XDR agents

T1105Ingress Tool TransferEvidence7

The compressed file containing XMRig was downloaded through the following command: > Bitsadmin /transfer

T1219Remote Access ToolsEvidence4

駭客在入侵政府機關內部的主機與伺服器後,為了要長期潛伏以及將獲取資料傳出,還會安裝 SoftEther VPN 程式,以連線到駭客指定的中繼站。

T1572Protocol TunnelingEvidence2

building VPN servers on compromised public-facing servers to establish access into the private network of victims

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

駭客在入侵政府機關內部的主機與伺服器後,為了要長期潛伏以及將獲取資料傳出,還會安裝 SoftEther VPN 程式,以連線到駭客指定的中繼站。

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

7 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

uri●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

security affairsNews

Feb 26, 2026

Google GTIG disrupted China-linked APT UNC2814 halting attacks on 53 orgs in 42 countries

Legitimate VPN software abused post-compromise to establish an encrypted outbound connection (tunneling) from victim environments.

checkpoint research blogNews

Feb 23, 2026

2025: The Untold Stories of Check Point Research - Check Point Research

Legitimate VPN software abused/installed by attackers for remote access and persistence (noted masquerading as conhost.exe).

checkpoint research blogNews

Feb 23, 2026

2025: The Untold Stories of Check Point Research - Check Point Research

Legitimate VPN software deployed/abused to provide remote access and persistence (noted in an intrusion linked by vendors to Flax Typhoon).

the hacker newsNews

Oct 14, 2025

Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year

SoftEther VPN, in this context, is a legitimate VPN software repurposed by attackers as a backdoor. By renaming and installing it as 'bridge.exe', attackers establish a covert VPN tunnel to maintain persistent, stealthy access to the compromised network.

+7 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution5

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SoftEther VPN