Provider of Malicious VPN apps Disguised as Popular Vendors

Zscaler ThreatLabZ documents a May 2021 campaign where attackers registered lookalike VPN websites (e.g., vpnnords.com) to host fake installers that deploy legitimate VPN software visibly while covertly executing obfuscated components that disable Windows Defender, decrypt embedded payloads, and load an obfuscated .NET chain culminating in process hollowing to execute the Raccoon infostealer; the report includes detailed static/dynamic analysis, MITRE ATT&CK mapping, and IOCs (file hashes, malicious domains, and dropped file paths).