Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – The attackers initially breached web servers and executed commands through the web service (‘the web server was attacked during the Initial Intrusion phase’).
• [T1018 ] Remote System Discovery – They enumerated nearby systems and network state using commands like whoami, netstat, tasklist, and systeminfo (‘Whoami’, ‘Netstat -ano’, ‘Tasklist’, ‘Systeminfo’).
• [T1135 ] Network Share Discovery – They checked network-related connectivity and environment details during discovery (‘Netstat -ano -p tcp’, ‘Ping 8.8.8.8’).
• [T1082 ] System Information Discovery – They collected host details with systeminfo, ipconfig, and related commands (‘Systeminfo’, ‘Ipconfig /all’).
• [T1046 ] Network Service Discovery – They inspected listening services and ports with netstat to understand exposed services (‘Netstat -ano -p tcp’).
• [T1105 ] Ingress Tool Transfer – They downloaded malware and configuration files using PowerShell, certutil, and curl (‘PowerShell iwr -uri…’, ‘Certutil -urlcache -split -f…’, ‘Curl … -o …’).
• [T1059.001 ] PowerShell – PowerShell was used to download files and execute commands for installation (‘PowerShell iwr -uri … -OutFile …’).
• [T1106 ] Native API – The attackers used built-in Windows utilities such as certutil and bitsadmin to stage files (‘using utilities such as PowerShell, bitsadmin, and Certui’).
• [T1112 ] Modify Registry – They set the UseLogonCredential registry key to enable WDigest plaintext password storage (‘the setting of the UseLogonCredential registry key’).
• [T1003.001 ] OS Credential Dumping: LSASS Memory – The registry change indicates preparation for plaintext credential theft (‘intended for the subsequent credential theft’).
• [T1087.001 ] Local Account Discovery – They queried authentication providers and local policy to understand account and login configuration (‘Reg query … AuthenticationCredential Providers’).
• [T1012 ] Query Registry – The attackers queried registry values related to credential providers (‘Reg query “HKLMSOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential Providers”’).
• [T1518 ] Software Discovery – They checked installed authentication methods and system state (‘determine which authentication methods are installed’).
• [T1482 ] Domain Trust Discovery – They verified whether the system was joined to a domain (‘verify whether the system is joined to a domain’).
• [T1510 ] Application Layer Protocol – The infection relied on HTTP-based downloads from multiple servers (‘hxxp://…/Download/…’).
• [T1071.001 ] Web Protocols – The attackers used HTTP and likely web service traffic for command and file delivery (‘executed via the web service’).
• [T1005 ] Data from Local System – The SqlShell supported collecting data such as memory dumps from the victim host (‘memory dumps’).
• [T1068 ] Exploitation for Privilege Escalation – SqlShell included privilege escalation using BadPotato and EfsPotato (‘privilege escalation using BadPotato and EfsPotato’).
• [T1136.001 ] Create Account: Local Account – The attackers attempted to add a local user account named administrator (‘add an account named “administrator”’).
• [T1055 ] Process Injection – The article states the shell can execute shellcode, which is commonly associated with code injection or execution of arbitrary code (‘executing shellcode’).