Attack Cases in Korea Involving the Installation of Radmin and UltraVNC

ASEC observed an active campaign targeting Korean users in which attackers deploy Radmin via a downloaded archive and use it to install UltraVNC and proxy/VPN tools (Netch, CCProxy, SoftEther) to seize control of hosts and repurpose them as proxy/VPN nodes. The report provides multi-stage infection details (PowerShell download/execution, PyInstaller/Go-built installers, service/task persistence), configuration and registry artifacts, C2 endpoints, example URLs/FQDNs/IPs, and MD5 hashes for file IOCs, and suggests a likely Chinese-speaking actor based on language and configuration indicators.