Malware Supported VPN Network Used By APT Groups

RSA reported that a China-focused VPN service (dubbed "Terracotta") is actually supported by a global network of malware-infected Windows servers — over 1,500 nodes — used since at least 2013 to bypass the Great Firewall and mask malicious operations; compromises typically involved Internet-exposed servers, brute-force RDP access, and planting additional malware, and RSA ties the infrastructure to sophisticated threat actors with possible Chinese military links and will publish IOCs.