Analysis of Attack Case Installing SoftEther VPN on Korean ERP Server

AhnLab ASEC discovered an attack on a Korean company's ERP server where the attacker abused an exposed MS-SQL service to gain access, deployed a web shell, exfiltrated credentials (Mimikatz-related activity), and installed SoftEther VPN (configured in cascade mode) to turn the host into a relay/C2 infrastructure. The report provides command logs, downloader behavior, file detections, MD5 hashes, and URLs used to deliver payloads, and recommends stronger password management and network access controls for database servers.