CL-STA-1062 SoftEther VPN Components Staged from 139.180.134.221/sdksdk608

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

Detects the download, staging, and execution of SoftEther VPN components associated with CL-STA-1062. The rule monitors for the creation of specific SoftEther files, network downloads from known actor staging infrastructure, and the execution of SoftEther binaries masquerading as VMware tools (vmtools.exe).