Larva-26010Threat actor

Larva-26010 targets web servers and MS-SQL servers in Korea to install SoftEther VPN, using the systems as VPN servers. After the initial breach, the actor installs a web shell or SQLShell for control, followed by the SoftEther installation. The threat actor has not exhibited additional malicious behavior beyond installing backdoor accounts or web shells.From MISP Galaxy

Last reported 2 months ago, by AhnLab ASEC1 report

ATT&CK techniques

1 technique · each with the sentence it comes from

T1505.003Web Shell

“…acker used utilities such as PowerShell, bitsadmin, and Certui to install SoftEther VPN and is believed to have ultimately installed a web shell.”

AhnLab ASECVendor10 Aug 2026

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

“…r currently carrying out similar attacks exhibits the same characteristics as the case described above and is therefore classified as Larva-26010.”

AhnLab ASECVendor10 Aug 2026
Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea

Indicators in its reports

named in the reports above

hxxp://64.176.55[.]16/Download/menu.Batin 1 report
64.176.55[.]16in 1 report
hxxp://139.180.210[.]71/Download/m2.Batin 1 report
139.180.210[.]71in 1 report
hxxp://45.76.144[.]150/Download/m2.Batin 1 report
45.76.144[.]150in 1 report
hxxp://139.180.210[.]71/Download/us320250823.Cab%E2%80%9Din 1 report
proxy[.]cabin 1 report
hxxp://64.176.55[.]16/Download/us31231131.Cab%E2%80%9Din 1 report
hxxp://64.176.55[.]16/Download/vmtoolsd.Se2%E2%80%9Din 1 report
hxxp://sendit[.]sh/Ebhcz/hamcore.Se2in 1 report
hxxp://sendit[.]sh/LLXkB/dUHxy.Configin 1 report
hxxp://69.48.229[.]196:8080/Download/server.Config.Hrxin 1 report
69.48.229[.]196in 1 report
hxxp://69.48.229[.]196:8080/Download/core.Imgin 1 report
hxxp://45.76.144[.]150/Download/us3202508234.Cab%E2%80%9Din 1 report
hxxp://69.48.229[.]54:8080/1/Vmtoolsd.Exein 1 report
69.48.229[.]54in 1 report
hxxp://69.48.229[.]54:8080/1/2.Configin 1 report
hxxp://bashupload[.]app/p62mh8.Binin 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

hxxp://64.176.55[.]16/Download/menu.Bat
64.176.55[.]16
hxxp://139.180.210[.]71/Download/m2.Bat
139.180.210[.]71
hxxp://45.76.144[.]150/Download/m2.Bat
45.76.144[.]150
hxxp://139.180.210[.]71/Download/us320250823.Cab%E2%80%9D
proxy[.]cab
hxxp://64.176.55[.]16/Download/us31231131.Cab%E2%80%9D
hxxp://64.176.55[.]16/Download/vmtoolsd.Se2%E2%80%9D
hxxp://sendit[.]sh/Ebhcz/hamcore.Se2
hxxp://sendit[.]sh/LLXkB/dUHxy.Config
hxxp://69.48.229[.]196:8080/Download/server.Config.Hrx
69.48.229[.]196
hxxp://69.48.229[.]196:8080/Download/core.Img
hxxp://45.76.144[.]150/Download/us3202508234.Cab%E2%80%9D
hxxp://69.48.229[.]54:8080/1/Vmtoolsd.Exe
69.48.229[.]54
hxxp://69.48.229[.]54:8080/1/2.Config
hxxp://bashupload[.]app/p62mh8.Bin

Thanks — we review every report.

Report a wrong match