SoftEther VPN: Identifying VPN Software Across the Internet

Censys analysis documents the global footprint of SoftEther VPN servers (over ~148,000 observed) and shows that multiple threat groups — including APT41, Gallium, Venomous Bear, and Hydrochasma — have installed or exploited SoftEther to maintain persistent access and enable follow-on actions; the report includes geographic and ASN distributions, protocol counts (IKE, SSH), and notes reported exploitation of SoftEther vulnerabilities to deploy ‘Skeleton Key’ malware.