← Back to Feed
Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea
August 10, 2026 · AhnLab ASEC · Severity: MEDIUM
AhnLab ASEC reports ongoing attack campaigns targeting web servers in Korea to install open-source SoftEther VPN, following similar patterns observed in 2024 against ERP servers.
Key Takeaways
- Attackers are targeting Korean web servers to install SoftEther VPN as a persistent access tool.
- SoftEther VPN, an open-source VPN solution, is being abused by threat actors for covert network tunneling.
- Security teams should monitor for unauthorized VPN installations on public-facing web servers in Korea.