Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)

Sep 16, 2026 · Original article ↗

Summary

ASEC reports that the Larva-25012 threat actor resumed proxyware distribution in the second half of 2026, apparently using previously installed DPLoader infections to install DigitalPulse, SOAX, Appsalt, and IPRoyal. PowerShell scripts downloaded proxyware, registered scheduled tasks, and in the DigitalPulse case attempted to disable Microsoft Defender. ASEC recommends avoiding executable downloads from suspicious or file-sharing sites and installing a V3 product on infected systems.

Key points

Larva-25012 has distributed proxyware since at least 2025, previously using YouTube download pop-up ads, a disguised GitHub tool, and illegal software crack-download pages.
Recent activity appears to reuse already-installed DPLoader, which collects system information, communicates periodically with a C&C server, and can execute PowerShell commands received from it.
Observed proxyware installations included DigitalPulse, SOAX, Appsalt, and IPRoyal; earlier activity also involved Honeygain and Infatica.
PowerShell scripts installed proxyware and created scheduled tasks with names including PlutonAgentScheduler, EnterpriseMgmtServicesScheduler, SecurityHealthServiceSyncUpdate, and BackgroundTaskRegistrationMaintenanceTaskScheduler.
The report says DigitalPulse used obfuscation and injection into the Explorer process to evade detection; SOAX, Appsalt, and IPRoyal were installed with loaders and SDK DLLs.
ASEC reports that numerous systems in Korea have been targeted. It advises downloading executables only from trusted official sites and installing a V3 product on infected systems.

Attack Vectors

Previously infected systems with DPLoader were apparently reused to install proxyware through PowerShell commands.
Earlier distribution used pop-up ads on YouTube download sites, a disguised GitHub tool, and illegal software crack-download pages.

Defensive Notes

Avoid installing executable files from suspicious websites with ads or pop-ups and from file-sharing sites; use official websites.
For infected systems, ASEC recommends installing a V3 product to prevent further malware infections.

Indicators of compromise

Type	Indicator	Context
MD5	`0066422310c880d5e722ba59ad315df1`	MD5 indicator listed by the report for this campaign.
MD5	`10498a91dcb16561e32487a47b9832f7`	MD5 indicator listed by the report for this campaign.
MD5	`1fdf8668882272280f1b53b4443a4906`	MD5 indicator listed by the report for this campaign.
MD5	`286380d04f0d5a9f800a2b6cb23e080a`	MD5 indicator listed by the report for this campaign.
MD5	`2e73e08b1e9a3edd3dfa024040b9467e`	MD5 indicator listed by the report for this campaign.
URL	`hxxp[:]//dci6j1p0q6khn[.]cloudfront[.]net/784365567456345[.]Ps1`	PowerShell script URL used to install IPRoyal proxyware.
URL	`hxxp[:]//dhrciu5akloar[.]cloudfront[.]net/63563545600333[.]Ps1`	PowerShell script URL used to install SOAX proxyware.
URL	`hxxp[:]//pub-43fc211373d547278dd3d5bd0b4d9dac[.]r2[.]dev/87648736456384[.]Ps1`	PowerShell script URL used in the DigitalPulse installation commands.
URL	`hxxps[:]//7jb7qi6vnr5pa22a4br4irz3tu0yqzbd[.]lambda-url[.]us-east-1[.]on[.]aws/e`	Listed by the report as a C&C and reporting address for the SOAX case.
URL	`hxxps[:]//d36rb13t9es4g1[.]cloudfront[.]net/192837455732[.]ps1`	URL listed in the article’s URL indicators.
URL	`hxxps[:]//d3mz24vhl6xvgp[.]cloudfront[.]net/CopilotService[.]exe`	URL listed in the article’s URL indicators.
URL	`hxxps[:]//d3mz24vhl6xvgp[.]cloudfront[.]net/liblivenet_amd64[.]dll`	URL listed in the article’s URL indicators.
URL	`hxxps[:]//d6nue5fz4t6y8[.]cloudfront[.]net/9083743654554665[.]ps1`	URL listed in the article’s indicators and used in the Appsalt installation command.