A PowerShell process on a Korean machine pulls down a zip file and unpacks a batch script that installs Radmin, a perfectly legitimate remote desktop product, into C:\Intel\RServer. Nothing in that sequence looks like malware. That is the point.
Researchers at the AhnLab Security intelligence Center (ASEC) have documented attacks in South Korea in which the intruders never bring their own backdoor. They install commercial and open source remote control software instead, configure it to answer to them, and then put the machine's internet connection to work for somebody else as a proxy relay or a VPN server.
Legitimate software, the attacker's settings
The first stage is Radmin. A batch file named 11.Bat drops the Radmin Server component and imports a registry file that sets the listening port, the login and the operator's account name, which ASEC records as "ruxin". After that, the machine's IP address and the credentials they chose are enough to open a full remote desktop session. How the attackers reached these systems in the first place is still unknown, ASEC says; the trail only picks up at the PowerShell download.
A second remote desktop, hidden in the Fonts folder
Radmin is then used to install a second one. A hidden PowerShell command pipes a remote script into memory and drops UltraVNC into C:\Windows\Fonts\web, a path chosen because nobody browses there. The loader registers itself as a Windows service called WpnUserHost and schedules a task that re-downloads a repair script every hour, so removing the payload without the task simply invites it back.
Each installer generates a random VNC port and password and reports them to a control server. Early samples were packed with PyInstaller; recent ones are compiled in Go, which suggests somebody is still maintaining this.
The machines are the product
Control is not the only goal. On top of the two remote desktops the operators layer proxy software: Netch-gateway, which speaks SOCKS5, Shadowsocks and KCP, and earlier CCProxy, set to open a SOCKS proxy on port 49661. Most recently they have added SoftEther VPN, dropped as a file named svchost.Exe to pass for a Microsoft component, turning the victim's PC into a VPN server outright.
The economics are familiar. A compromised connection is worth money as clean-looking egress for other people's traffic, the market that made the NetNut proxy network worth disrupting. Nothing is encrypted and there is no ransom note. The victim simply becomes the address somebody else's activity appears to come from.
Chinese-language clues, and a script that may have been written by AI
ASEC stops short of naming a group. It notes that the deployment scripts carry comments in Chinese, that the configuration data is in Chinese, and that the address Netch-gateway registers with serves a Chinese-language proxy service page. On that basis it assesses the operator is possibly a Chinese speaker, and goes no further. Neither should anyone else.
One detail stands out: the UltraVNC installation script tries to add antivirus exclusions for files that do not exist on the system, which ASEC reads as a sign the script may have been generated by AI rather than written by someone who tested it.
What to hunt for
Look for Radmin Server under C:\Intel\RServer, an install folder at C:\Windows\Fonts\web, a service or task named WpnUserHost or WpnUserHost_HourlyWatchdog, and outbound SOCKS traffic on port 49661. Reported indicators, defanged here, include the staging host 103[.]86[.]86[.]244, the control server tt[.]yeyoujs[.]com, and the domains tvip[.]yeyoujs[.]com, koreakr[.]top and www[.]sheng886[.]top.
The full analysis and indicator set is in ASEC's report. It lands in a country whose attackers have spent the year leaning on things that already look normal, from shortcut files as the leading APT lure to off-the-shelf remote desktop tools; our South Korea threat profile has the wider picture. The uncomfortable part is that none of the software here is malicious. Only the configuration is.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.