Attack Cases in Korea Involving the Installation of Radmin and UltraVNC

Observed attack campaigns targeting Korean users involve the deployment of remote control software Radmin and UltraVNC. The initial infection vector is unknown, but attackers download compressed archives containing batch scripts and remote administration tools. Following Radmin installation, attackers deploy UltraVNC alongside proxy tools such as Netch-gateway and CCProxy, leveraging compromised systems as proxy nodes. Recent variants include deployment of SoftEther VPN to establish VPN servers on infected infrastructure. PowerShell scripts with Chinese language comments and tools familiar to Chinese-speaking actors suggest attribution to Chinese threat operators. The campaigns facilitate both remote system control and abuse of compromised systems for proxy services.

Compromised systems allow attackers to remotely control the machines and use them as proxy nodes, potentially enabling further malicious activities such as anonymizing traffic or relaying attacks. Deployment of VPN servers on infected infrastructure increases the complexity and stealth of attackers' operations. The campaign impacts the confidentiality and integrity of affected systems and may facilitate broader network abuse.

No specific patch or fix is available as this is a campaign leveraging legitimate remote administration tools. Defenders should focus on detecting and blocking the download and execution of the identified malicious scripts and tools. Monitoring for installation and use of Radmin, UltraVNC, Netch-gateway, CCProxy, and SoftEther VPN in unauthorized contexts is recommended. Network defenders should block known malicious domains, IPs, and URLs associated with this campaign as listed in the indicators. Since the initial intrusion vector is unknown, maintaining strong endpoint protection and user awareness to prevent initial compromise is advised.