Larva-24010
- First seen
- 2023-01-01 00:00:00
- Primary motivation
- espionage
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- unknown
- Profile updated
- 2026-07-07 12:22:19
Targeted industries: technology-and-telecommunications
Targeted regions: country_code:kr
Context
The Larva-24010 threat actor is distributing malware through the website of a Korean VPN service provider. As a result, when a user downloads and runs the installer from the VPN website, malware can be installed on the system. Since at least 2023, the Larva-24010 threat actor has been targeting Korean VPN users to spread malware, ultimately installing various backdoors such as MeshAgent, gs-netcat, and NKNShell. Through this, the attacker can control infected systems where the VPN is installed and steal sensitive information stored on those systems.
Reports & references
- asec.ahnlab.com — 91139 (report)