⤷ Title: Trojanized VPN Installer Deploys NKNShell Backdoor, Using P2P Blockchain and MQTT Protocols for Covert C2
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 22 Nov 2025 00:10:21 +0000
════════════════════════
⌗ Tags: #Malware #ASEC #Blockchain Protocol #Go malware #MQTT #NKNShell #P2P C2 #Supply Chain #VPN Installer
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 22 Nov 2025 00:10:21 +0000
════════════════════════
⌗ Tags: #Malware #ASEC #Blockchain Protocol #Go malware #MQTT #NKNShell #P2P C2 #Supply Chain #VPN Installer
Daily CyberSecurity
Trojanized VPN Installer Deploys NKNShell Backdoor, Using P2P Blockchain and MQTT Protocols for Covert C2
ASEC exposed a VPN supply chain attack deploying NKNShell, a Go-based backdoor that uses P2P NKN and MQTT for stealthy C2. The installer bypasses AMSI using AI-generated code and grants full remote access (MeshAgent, gs-netcat).