SoftEther
Open-source VPN software developed at Japan's University of Tsukuba.
SoftEther VPN was named on 8 October 2026 in joint advisory AA26-281A, which says China-linked intruders enabled by Beijing's Integrity Technology Group installed it so their access survived a reboot.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why did China-linked hackers rely on free, open-source VPN software?
Timeline for SoftEther
Ten agencies name Beijing firm in hacks
Cybersecurity: Threats and DefencesBackground
SoftEther VPN is free, open-source, cross-platform VPN software released under the Apache License 2.0. It began as an academic project at the University of Tsukuba in Japan and runs on Windows, Linux, Mac, FreeBSD and Solaris.
Japan's National Police Agency and National Cybersecurity Office named the SoftEther VPN client on 9 October 2026 in their release of joint advisory AA26-281A. The advisory, signed by ten agencies from seven countries, says China-linked actors enabled by Integrity Technology Group installed a VPN with PowerShell so their access survived a reboot. It describes the actors using SoftEther alongside open-source scanners and password spraying against Microsoft Exchange Server, with indicators of compromise dating back to January 2016.
Sixteen agencies had named the same company with Flax Typhoon over a router botnet in April. Free, widely used tools such as SoftEther give state-linked intruders persistence that blends in with legitimate use.
Intruders used SoftEther to keep access
Joint advisory AA26-281A, signed by ten agencies from seven countries on 8 October 2026, describes SoftEther as a persistence tool. China-linked actors enabled by Integrity Technology Group installed the VPN with PowerShell so their access survived a reboot.
Japan's National Police Agency and National Cybersecurity Office named the SoftEther client on 9 October in their own release of the advisory, which pairs it with open-source scanners and password spraying against Microsoft Exchange Server. Indicators of compromise date back to January 2016. For SoftEther, the finding is about misuse rather than a flaw: legitimate, free software made the attackers' foothold look like ordinary network traffic.
