Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN

**Executive summary:** This ASEC intelligence report documents an active campaign by Larva-26009 exploiting MS-SQL servers to deploy XMRig coinminer and establish persistent remote control using VShell, GotoHTTP, SoftEther VPN, backdoor accounts, and legitimate remote-access tools; it also details credential-theft activity, privilege-escalation tools, shellcode loaders, internal scanning, and provides multiple IOCs (file hashes, URLs, FQDNs, IPs) for detection and remediation.