Loading malware…
HVNC, short for Hidden VNC, is a covert remote-control malware class that gives an operator interactive access to a victim Windows system through a separate hidden desktop session rather than the user’s visible desktop. This design allows attackers to browse files, execute commands, interact with applications, and conduct fraud or post-compromise activity without obvious on-screen indicators to the victim. Unlike conventional VNC or many standard RATs, HVNC is specifically intended to keep attacker activity invisible during live remote control.
Observed HVNC implementations have appeared both as standalone payloads and as modules delivered by broader malware chains. Documented capabilities across reported samples and campaigns include hidden remote desktop control, command execution, file browsing, keylogging, proxying, in-memory execution, persistence, and process injection. Some variants have been used to search for browser-based cryptocurrency wallet extensions and to facilitate theft of credentials, sessions, private keys, or other sensitive data by enabling covert interaction with browsers and wallet interfaces.
HVNC has been associated with multiple threat ecosystems. North Korea-linked Kimsuky operations have used HVNC alongside malware such as AppleSeed, PebbleDash, XRat, Amadey, and Meterpreter in spear-phishing intrusions targeting South Korean and related sectors. Financially motivated malware operations have also deployed HVNC as a follow-on module, including OpcJacker campaigns tied to fake software distribution and cryptocurrency theft. Additional campaigns have delivered HVNC through trojanized software installers, job-themed phishing lures, and multi-stage loader chains, including Python-based payload sets and signed Windows deployment abuse. Banking-fraud-oriented activity has also used HVNC to covertly manipulate victim browsers and sessions.
HVNC is most strongly associated with Windows environments because it relies on Windows desktop and process mechanisms to create or abuse hidden desktop contexts and to inject or launch remote-control components. It is commonly delivered after initial compromise by loaders, droppers, or backdoors rather than serving as the first-stage payload itself. In practice, HVNC is best understood as a stealth-focused remote access capability used in espionage, cybercrime, banking fraud, and cryptocurrency theft operations where invisible operator interaction with the victim host is operationally valuable.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Malware used by the Kimsuky group not only include custom-made such as AppleSeed and PebbleDash, but also open-source or commercial malware such as XRat, HVNC, Amadey, and Metasploit Meterpreter.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
“In some cases, a scheduled task is created, with various names, such as 123456.exe.”
“These DLLs usually act as loaders for malicious batch scripts… @echo off… reg add… start …”
Execution Command and Scripting Interpreter: Python T1059.006 Obfuscated Python payloads
The strings [INJ] === Section-based injection into explorer.exe === and [INJ] Remote thread created in explorer.exe! describe a sequence in which the loader creates a shared memory section via NtCreateSection ... and starts a remote thread via NtCreateThreadEx.
“If the ZIP archives are opened, they initiate an infection chain leading to the installation of PureRAT or another payload such as a HVNC.”
“The archives usually contain an executable, which is then used to sideload a malicious DLL… Haihaisoft PDF Reader or an old version of Microsoft Excel… renamed version of the Foxit PDF reader for sideloading… malicious DLLs included: oledlg.dll, msimg32.dll, version.dll, and profapi.dll.”
Defense Evasion Obfuscated Files or Information T1027 Kramer Python obfuscator, .pyc as .py
“phishing emails… masquerading as job offers… attackers renamed the executable to masquerade as something else… adobereader.exe… Salary and Benefits.exe… After the persistence mechanism… masquerading as ChromeUpdate.”
To run the HVNC payload covertly, the loader is equipped to inject the DLL into explorer.exe using a technique known as section-based injection.
“Tạo tiến trình InstallUtil.exe ngầm (ẩn cửa sổ) … target_path = …\InstallUtil.exe”
MITRE ATT&CK Mapping ... Execution Regsvr32 T1218.010 DLL registration via regsvr32 /s
Windows supports the CreateDesktop() API that can create a hidden desktop window with its own corresponding explorer.exe process. All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session, will be invisible to other desktops windows.
“creates a hidden directory under %LOCALAPPDATA%\Google Chrome… attrib +h +s”
In addition, Windows supports the CreateDesktop() API that can create a hidden desktop window with its own corresponding explorer.exe process. All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session, will be invisible to other desktops windows.
Operators can use HVNC to control a hidden browser session, run a keylogger, take screenshots, and manage files remotely.
Windows supports the CreateDesktop() API that can create a hidden desktop window with its own corresponding explorer.exe process. All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session, will be invisible to other desktops windows.
“The archives usually contain an executable, which is then used to sideload a malicious DLL… Haihaisoft PDF Reader or an old version of Microsoft Excel… renamed version of the Foxit PDF reader for sideloading… malicious DLLs included: oledlg.dll, msimg32.dll, version.dll, and profapi.dll.”
In our analyzed sample, command-and-control (C&C) communication starts with the following magic: The snippet below shows that some values are hardcoded into the executable, others are generated from MachineGuid or randomly generated.
48 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Go-based remote access trojan with hidden virtual network computing capability that provides remote control, command execution, file browsing, keylogging, proxying, in-memory execution, persistence, and covert desktop interaction.
A Hidden Virtual Network Computing payload that creates an invisible desktop session, allowing attackers to browse, access accounts, and interact with authenticated sessions without anything appearing on the victim’s visible screen. The article notes it is primarily associated with financial fraud operations.
A suspected HVNC payload identified from the DLL naming convention in the March 26 campaign, likely intended to provide hidden remote desktop capability.
Hidden VNC remote access payload delivered in multiple obfuscated Python variants and also referenced in historical DLL form.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.