Excerpt
The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases in which attackers targeted web servers in Korea to install SoftEther VPN. Attack cases involving the installation of SoftEther VPN, an open-source VPN, were previously discussed in the 2024 ASEC blog post titled “Analysis of Attack Cases Targeting ERP Servers in Korea to Install SoftEther VPN” [1]. The threat actor currently carrying out similar attacks exhibits the same characteristics as the case described above and is therefore classified as Larva-26010. It appears that the threat actor ultimately installed the SoftEther VPN servi…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by AhnLab on asec.ahnlab.com.
More from AhnLab6
- From El Dorado to BlackLock: Inside a Fast-Rising RaaS ThreatAhnLab · Published 15 Sep 2025
- Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)AhnLab · Published 3 Aug
