Attack Cases in Korea Involving the Installation of Radmin and UltraVNC

Observed attack campaigns targeting Korean users involve deploying remote control software Radmin and UltraVNC. The initial infection vector is unknown. Attackers download compressed archives containing batch scripts and remote administration tools. Following Radmin installation, UltraVNC is deployed alongside proxy tools like Netch-gateway and CCProxy, leveraging compromised systems as proxy nodes. Recent variants include SoftEther VPN deployment to establish VPN servers on infected infrastructure. PowerShell scripts with Chinese language comments and tools familiar to Chinese-speaking actors suggest attribution to Chinese threat operators. The campaigns facilitate remote system control and infrastructure abuse for proxy services.

Compromised systems allow attackers to remotely control the machines and use them as proxy nodes, potentially enabling anonymized traffic routing or relaying attacks. Deployment of VPN servers on infected infrastructure increases operational stealth and complexity. The campaign impacts confidentiality and integrity of affected systems and facilitates broader network abuse through proxy services.

No specific patch or fix is available as this campaign leverages legitimate remote administration tools. Defenders should focus on detecting and blocking download and execution of the identified malicious scripts and tools. Monitoring for unauthorized installation and use of Radmin, UltraVNC, Netch-gateway, CCProxy, and SoftEther VPN is recommended. Network defenders should block known malicious domains, IPs, and URLs associated with this campaign as listed in the indicators. Since the initial intrusion vector is unknown, maintaining strong endpoint protection and user awareness to prevent initial compromise is advised.