How to convince someone that SoftEther VPN is not Malware?

So we recently had a client bring an old server out of retirement (Windows Server 2008 R1, last patched in 2011), and connected it to the net so we had a portal into their Office for management etc.

Being that the server is so old, our Management software did not want to run and so I set up a Softether VPN to my PC so I could use my local management tools and send everything over the VPN. This worked great, until the next morning the Server is infected with Ransomware and now the blame is being put on SoftEther.

I've been using SoftEther for about a year and have never come across this, can I be sure that the Server was compromised by being out of date and not by the VPN server?

Cheers