Loading story…
AhnLab ASEC identified intrusions targeting users in South Korea in which attackers installed the legitimate remote-access tools Radmin and UltraVNC to retain control of compromised endpoints. Initial access remains unknown, but observed PowerShell activity retrieved archives and scripts from 103.86.86.244, installed Radmin, and configured remote-access settings controlled by the attackers.
The operators also deployed Netch-gateway or CCProxy and, in more recent activity, SoftEther VPN, apparently converting victim systems into proxy or VPN relay infrastructure for further malicious operations. Attribution is unconfirmed; however, Chinese-language script comments and configuration content, familiar tooling, and linked proxy-service pages indicate the activity may be operated by a Chinese-speaking actor. Affected organizations should investigate unauthorized installations and configurations of these remote-control and proxy tools, as the activity enables persistent access, data theft, and abuse of corporate hosts as traffic relays.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
AhnLab ASEC identified attacks in South Korea in which attackers installed Radmin for remote access and subsequently deployed UltraVNC for persistent control. The operators also used compromised hosts as proxy or VPN infrastructure with Netch-gateway, CCProxy, and more recently SoftEther VPN; their initial-access method and identity remain unconfirmed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026
Rapid7 Labs identified a previously undocumented Linux espionage toolkit used against South Korean automotive and media organizations from at least early 2025. The toolkit includes a trojanized `HAProxy 2.8.12` build, dubbed **ted backdoor**, CurlRAT implanted in legitimate Linux daemons, a stager, and an SSH keylogger. Ted backdoor is integrated into HAProxy internals to intercept HTTP traffic, collect session material, inject scripts into selected web responses, execute commands, and suppress or evade logging. Rapid7 attributed the activity to DPRK-linked operators with medium confidence, citing infrastructure associations with **APT37**, while noting that the responsible cluster, initial-access method, and any exploited vulnerability remain unconfirmed. The operation follows broader DPRK activity against South Korean organizations, including Lazarus’s 2024–2025 SyncHole watering-hole campaign exploiting locally prevalent security and file-transfer software. Defenders should validate the integrity of HAProxy and Linux daemon binaries, hunt associated filesystem and C2 artifacts, and use independent network telemetry because compromised service logs may be unreliable.
Sep 5, 2026
Multiple threat actors have used **SoftEther VPN** to turn compromised servers into covert relay infrastructure and maintain persistent access after initial intrusion. AhnLab reported that the **Larva-26010** group targeted web and **MS-SQL** servers in Korea, installing SoftEther components under `ProgramData`, disguising binaries as legitimate files such as `vmtoolsd.Exe`, and configuring cascade connections to upstream VPN servers to mask command-and-control paths. The intrusions also involved discovery commands, deployment of **CLR SqlShell**, registry changes including `UseLogonCredential`, web shell installation, and in one case creation of a local administrator-like account. Other reporting shows the same tunneling approach appearing in broader espionage operations. Mandiant found that **UNC3500** exploited **Log4Shell** (`CVE-2021-44228`) on public-facing MobileIron servers and established persistence with a **SoftEther/PacketiX VPN Bridge**, while Kaspersky said **ToddyCat** used **SoftEther VPN Server** alongside reverse SSH tunnels, **ngrok**, **FRP**, and a custom proxy to preserve access and support large-scale data theft from government and defense-related targets in the Asia-Pacific region. Across the cases, SoftEther was used not as the initial exploit but as post-compromise infrastructure for stealthy remote access, lateral movement support, and exfiltration-enabling traffic tunnels.
Aug 18, 2026