Analysis of Attack Cases: From Korean VPN Installations to MeshAgent Infections

AhnLab Security Emergency response Center (ASEC) has previously covered the case where SparkRAT was distributed contained within a Korean VPN’s installer in the post, “SparkRAT Being Distributed Within a Korean VPN Installer”[1]. This VPN was commonly installed by Chinese users who required better access to the Internet, and the problem was addressed after the blog post was uploaded.

However, there have been recent cases indicating the resurgence of malware distributing SparkRAT through the installer of the same VPN …

access ahnlab analysis asec attack case cases center chinese distributed emergency infections installer internet malware analysis meshagent response security sparkrat vpn