Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections Posted By Sanseo , May 26, 2023 AhnLab Security Emergency response Center (ASEC) has previously covered the case where SparkRAT was distributed contained within a Korean VPN’s installer in the post, “SparkRAT Being Distributed Within a Korean VPN Installer”[1]. This VPN was commonly installed by Chinese users who required better access to the Internet, and the problem was addressed after the blog post was uploaded. However, there have been recent cases indicating the resurgence of malware distributing SparkRAT through the installer of the same VPN company. The…
SparkRAT Being Distributed Within a Korean VPN Installer Posted By Sanseo , May 18, 2023 AhnLab Security Emergency response Center (ASEC) has recently discovered SparkRAT being distributed within the installer of a certain VPN program. SparkRAT is a Remote Administration Tool (RAT) developed with GoLang. When installed on a user’s system, it can perform a variety of malicious behaviors, such as executing commands remotely, controlling files and processes, downloading additional payloads, and collecting information from the infected system like by taking screenshots. 1. Case of Distribution The VPN provider, whose installer contained SparkRAT appears to…
