NKNShell Malware Distributed via VPN Website

The NKNShell malware campaign involves a compromised South Korean VPN provider website used to distribute a multi-stage malware payload. The threat actor Larva-24010 deploys several backdoors including MeshAgent, gs-netcat, and a novel Go-based backdoor called NKNShell, which leverages NKN and MQTT protocols for command and control. The infection chain uses trojanized installers and PowerShell scripts, employing advanced evasion techniques such as AMSI and UAC bypasses. Additional tools like SQLMap are deployed to facilitate further exploitation. While primarily targeting Korean VPN users, the sophisticated use of blockchain-based networking protocols and multiple backdoors poses risks to any users of the compromised VPN service. The campaign's medium severity reflects its complexity and targeted nature, but it has not yet been observed exploiting widespread vulnerabilities or causing large-scale impact beyond South Korea.

• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• Angry Birds: Toy Ghouls’ new toysMalware2026-09-04
• July 2026 Threat Trend Report on APT Attacks (South Korea)Campaign2026-08-28
• INC and The Gentlemen Ransomware: Exposed AI InfrastructureMalware2026-10-21
• Dissection of Operation FlashHole, a complex attack by LazarusMalware2026-10-21