Malware Attack Cases in Korea Involving the Installation of Radmin and UltraVNC

Summary

Threat actors are targeting users in South Korea to install remote access tools such as Radmin and UltraVNC. After gaining control, the attackers deploy additional proxy utilities including Netch-gateway, CCProxy, and SoftEther VPN. The apparent goal is to turn compromised systems into proxy nodes or VPN servers that can support further malicious activity.

Investigation

AhnLab Security Intelligence Center analyzed a multi-stage infection chain that begins with PowerShell-based downloads. Attackers use Radmin for initial remote control before deploying UltraVNC and several proxying tools. Chinese-language comments found in scripts, along with specific tool configurations, suggest that the activity may be linked to a Chinese-speaking threat actor.

Mitigation

Users should exercise caution when opening or executing files obtained from unknown or untrusted sources. Antivirus products such as V3 should be kept fully updated to help block known malware signatures. Organizations should also monitor endpoints for unauthorized remote desktop software, unexpected proxy tools, and unusual installations of VPN services.

Response

If malicious activity is detected, affected systems should be isolated from the network immediately to stop further command-and-control communication. Responders should conduct a complete forensic investigation to determine the initial access vector and scope of lateral movement. Network logs should also be reviewed for unauthorized SOCKS5, Shadowsocks, or VPN traffic originating from internal systems.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access to a workstation and intends to establish persistence and remote control using Radmin or UltraVNC. To evade detection, they download a script that automates the installation. The attacker’s goal is to use a highly specific, non-descript filename (11.Bat) to avoid suspicion from manual file inspections, and they attempt to mask the installer’s execution by mimicking the name of a critical system process (svchost.Exe) in the command line. These actions are designed to trigger the specific string-matching logic of the target detection rule.

• Regression Test Script:

    # Simulation of Radmin/UltraVNC deployment via '11.Bat'
    New-Item -Path "$env:TEMP11.Bat" -ItemType "File" -Value "echo Installing Remote Access Tool..."
    Start-Process -FilePath "cmd.exe" -ArgumentList "/c $env:TEMP11.Bat"
    Write-Host "[+] Simulation: 11.Bat executed."
  
    # Simulation of anomalous 'svchost.Exe' usage in command line
    # Note: This is a simulated command string to trigger the rule logic
    Start-Process -FilePath "cmd.exe" -ArgumentList "/c svchost.Exe /install_vnc_dummy_param"
    Write-Host "[+] Simulation: Anomalous svchost.Exe command line executed."

• Cleanup Commands:

    Remove-Item -Path "$env:TEMP11.Bat" -Force
    Write-Host "[+] Cleanup: Simulation artifacts removed."