Attackers Use Radmin and UltraVNC to Control Korean Systems and Turn Them Into Proxy and VPN Servers

Sep 2, 2026 · Original article ↗

Summary

AhnLab describes attacks on Korean users that install Radmin and UltraVNC for remote control, then add proxy tools or SoftEther VPN to repurpose infected systems. The initial intrusion method and attacker identity remain unknown.

Key points

The initial access method is unknown; a PowerShell process was observed downloading an archive containing a batch script, registry file, and Radmin.
Attackers configure Radmin for remote access, then use it to deploy UltraVNC and related tools.
UltraVNC components establish persistence with Windows services and scheduled watchdog tasks, add firewall rules, and report device and VNC details to a command-and-control server.
The attackers installed CCProxy and Netch-gateway to use infected systems as proxy nodes; more recent cases added SoftEther VPN servers.
AhnLab warns that infected systems could expose sensitive information and be misused for third-party activity.
The actor has not been identified; Chinese-language script comments and configuration suggest, but do not confirm, a Chinese-speaking operator.
AhnLab advises avoiding executables from unknown sources and keeping V3 updated.

Article Details

Attack Vectors: The initial intrusion method is unknown. After access, attackers used Radmin to control infected systems and install UltraVNC, proxy tools, and SoftEther VPN.
A PowerShell process used curl to download a compressed file containing a batch script, a registry file, and Radmin from the identified payload server.
PowerShell commands executed scripts retrieved from the payload server to install UltraVNC and Netch-gateway.
A WinRAR SFX dropper was used to install CCProxy and, in later cases, SoftEther VPN.
The installed tools enabled remote control and use of infected systems as proxy nodes or VPN servers.
Defensive Notes: Exercise caution with executable files from unknown sources.
Keep V3 updated to the latest version to help block malware infections.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`koreakr[.]top`	Domain listed among indicators associated with the attack cases.
DOMAIN	`tt[.]yeyoujs[.]com`	C&C server domain in the UltraVNC installer configuration.
DOMAIN	`tvip[.]yeyoujs[.]com`	Domain listed among indicators associated with the attack cases.
DOMAIN	`www[.]sheng886[.]top`	Domain listed among indicators associated with the attack cases.
IPV4	`103[.]86[.]86[.]244`	Payload server used to distribute Radmin-related files, scripts, and UltraVNC components.
MD5	`02153f3fbb3611bc8b01eb347bf86c5a`	MD5 hash listed among indicators associated with the attack cases.
MD5	`08613b6f27bf240af3f84c88b839f034`	MD5 hash listed among indicators associated with the attack cases.
MD5	`0d3c1e06d135fd2018f271822335a599`	MD5 hash listed among indicators associated with the attack cases.
MD5	`0f906a7d2fc2b0bb73edcad8bc45bbdb`	MD5 hash listed among indicators associated with the attack cases.
MD5	`12cc737b0e5e9576525295da76fa53d2`	MD5 hash listed among indicators associated with the attack cases.
URL	`hxxp[:]//103[.]86[.]86[.]244:800/c/`	Malware distribution address identified in the installer configuration and IOC list.
URL	`hxxp[:]//103[.]86[.]86[.]244:800/c/config[.]example[.]json`	Listed resource on the malware distribution server.
URL	`hxxp[:]//103[.]86[.]86[.]244:800/c/ddengine64[.]dll`	Listed DLL resource on the malware distribution server.
URL	`hxxp[:]//103[.]86[.]86[.]244/gateway/ag[.]exe`	Listed malware-download URL hosted on the attack's payload server.
URL	`hxxp[:]//103[.]86[.]86[.]244/gateway/conima[.]exe`	Listed malware-download URL hosted on the attack's payload server.