Loading malware…
TightVNC is a legitimate open-source Virtual Network Computing utility that has been repurposed by threat actors as remote-control malware. In observed malicious use, operators deploy a customized TightVNC server component on compromised Windows systems to provide interactive graphical access to the victim host. A notable adaptation is use of reverse VNC functionality, allowing the infected machine to initiate the connection outward to an operator-controlled viewer, which can help bypass firewall and network-addressing constraints and avoid the need to install the software as a persistent service.
This tooling has been associated with North Korea-linked intrusion activity, particularly Kimsuky operations, where it has been delivered after initial compromise through the AppleSeed backdoor as part of post-compromise remote administration. It has also been listed among malware and tools associated with BlueNorOff-linked activity. In these campaigns, TightVNC functions as an operator access utility rather than as an initial infection mechanism, enabling hands-on control of the victim desktop for follow-on actions.
When used maliciously, TightVNC supports post-exploitation objectives by giving attackers direct remote access to the infected environment. Its use is consistent with espionage-focused intrusions targeting sectors such as national defense, defense industry, media, diplomacy, public institutions, academia, and other organizations of strategic interest, especially in South Korea and related foreign-affairs contexts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TightVNC is an open-source VNC utility, and the threat actor customizes it to use it. The Kimsuky group distributes TightVNC which is customized to allow the Reverse VNC feature to be used independently in the infected environment without installing a service.
Malware associated with BlueNorOff include: "DarkComet, Mimikatz, Nestegg, Macktruck, WannaCry, Whiteout, Quickcafe, Rawhide, Smoothride, TightVNC, Sorrybrute, Keylime, Snapshot, Mapmaker, net.exe, sysmon, Bootwreck, Cleantoad, Closeshave, Dyepack, Hermes, Twopence, Electricfish, Powerratankba, and Powerspritz"
12 distinct techniques documented for this family, organized by ATT&CK tactic.
“TightVNC… ‘Password’=hex… VNC uses the same hardcoded DES key… we decrypt it… openssl enc -des-cbc… output ‘sT333ve2’” | “Meeting_Notes_June_2018.html… ‘Username is TempAdmin (password is the same as the normal admin account password)’… VNC Install.reg… ‘Password’=hex… decrypt it… Audit.db… SELECT * FROM Ldap… decompile CascAudit.exe… hardcoded key/IV…”
VNC, also known as Virtual Network Computing, is a screen sharing system that remotely controls other computers. Similar to the commonly-used RDP, it is used to remotely access and control other systems.
Lateral Movement (TA0008) — T1021.001 Remote Desktop Protocol: Adversary connects to the system using RDP with valid credentials
Another characteristic is that it uses the reverse VNC method... HVNC of TinyNuke attempts to access the client from the server with the reverse VNC feature.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access software listed as associated with BlueNorOff operations.
Customized VNC-based remote control utility used by Kimsuky to access infected hosts via reverse VNC.
Remote access software referenced as being used for remote services/lateral movement in ransomware intrusions.
Remote access tool listed as post-infection malware/tooling used for remote control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.