Trojanized VPN Installer Deploys NKNShell Backdoor, Using P2P Blockchain and MQTT Protocols for Covert C2

On 22 November 2025, ASEC reported a new malware distribution campaign that compromised a major South Korean VPN provider, delivering multiple backdoors via a trojanised VPN installer. The threat actor, tracked as Larva-24010, has again weaponised the trojanised installer to deploy NKNShell, a Go-based backdoor that uses hybrid P2P and MQTT channels for C2.

The infection chain begins when users download the VPN installer from the compromised site; the ZIP archive contains a malicious installer while the legitimate VPN installation proceeds. NKNShell is described as generating a unique NKN ID, connecting to seed nodes, and reporting host information back to attacker-controlled addresses, with connections to MQTT brokers such as broker.emqx[.]io:1833, broker.hivemq[.]com:1833, broker.mqtt[.]cool:1833 and broker.mosquitto[.]org:1833.

ASEC notes the backdoor’s broad capability set, including file transfers, shellcode execution, token theft, remote proxy, DLL sideloading, DDoS commands, and extensive PowerShell and Python execution, underscored by its use of PowerShell and the Go-based payloads to evade security checks.