Executive Summary
AhnLab SEcurity intelligence Center (ASEC) has identified a multi-stage intrusion campaign targeting South Korean users. While the initial infection vector remains unconfirmed, the campaign is characterized by the sequential deployment of legitimate remote administration tools (RATs) like Radmin and UltraVNC to maintain persistent access. The threat actor subsequently converts compromised systems into proxy nodes or VPN servers using tools such as Netch-gateway, CCProxy, and SoftEther VPN.
The technical chain involves PowerShell-based distribution and registry-based configuration of services to bypass detection. Evidence including Chinese-language comments in scripts and the use of infrastructure tied to Chinese proxy services suggests a Chinese-speaking threat actor is responsible.
The primary business impact includes the potential for sensitive data exfiltration and the misuse of corporate infrastructure for malicious proxy traffic, which can lead to IP blacklisting and increased liability for affected organizations.