NKNShell Malware Distributed via VPN Website

ASEC confirms an active campaign by Larva-24010 delivering a trojanized Go-based VPN installer which drops PowerShell loaders that install MeshAgent, NKNShell (a Go backdoor using NKN and MQTT for C2), gs-netcat, and SQLMap; the report analyzes the installer behavior, persistence (WMI filters, scheduled tasks), AMSI/ETW bypasses, NKNShell command capabilities and update mechanism, and provides MD5 hashes, URLs, and domains as IOCs.