{
  "family": "darkvnc",
  "sample_count": 3,
  "category": "ransomware",
  "description": "HackTool:Win32/Darkvnc is an incredibly dangerous and specialized Remote Access Trojan (RAT) component. It is a highly customized, stealthy implementation of the Virtual Network Computing (VNC) protocol. Unlike legitimate remote administration tools (like TeamViewer or AnyDesk), DarkVNC is designed to establish a *hidden secondary desktop session* (`T1021.005`) on the victim's machine, allowing an attacker full, interactive graphical control without the legitimate user ever knowing they are being watched.<br><br><b>Understanding DarkVNC (Stealth Remote Access)</b><br>To an end-user, DarkVNC is completely invisible; their screen does not flicker, and their mouse does not move on its own. For a security analyst, a DarkVNC detection indicates an advanced, active compromise. DarkVNC is rarely distributed on its own; it is almost always a premium module integrated into high-end Banking Trojans (like Trickbot, IcedID, or Ursnif) and Ransomware affiliate toolkits (like Cobalt Strike deployments).<br><br><b>Execution and Hooking Mechanics</b><br>Once the primary malware (e.g., IcedID) compromises the system (`T1566.001`), it drops and injects the DarkVNC DLL into a legitimate process (`T1055`). DarkVNC establishes an outbound connection to the C2 server, bypassing inbound firewall rules (`T1105`). When the attacker initiates a session, DarkVNC uses advanced Windows API hooking to create an invisible, secondary desktop environment (`HDESK`). It can capture the screen, inject keystrokes, and interact with banking portals or cryptocurrency wallets directly from the victim's trusted IP address and browser session (`T1539`), completely bypassing geo-fencing and device fingerprinting controls.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive compromise of the endpoint and the user's active sessions. Network IoCs include persistent, high-bandwidth outbound TCP connections to unknown IP addresses (often over non-standard ports or disguised as HTTPS). Host-based IoCs include EDR alerts for suspicious process injection (especially involving web browsers or `explorer.exe`), the creation of hidden desktop objects in memory, and anomalous API calls related to desktop switching (`SwitchDesktop`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1021.005",
    "T1539",
    "T1105",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1021.005",
      "name": "Remote Services: VNC (Hidden Desktop manipulation)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Loading the VNC DLL)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie (Abusing the trusted browser session)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint IMMEDIATELY; the attacker has active, graphical control and can disable security tools or move laterally.",
    "Assume all active sessions (banking, email, corporate VPN) on that machine are compromised and immediately revoke those session tokens.",
    "Perform a deep memory forensic analysis to locate the injected DarkVNC module and identify the parent process (often a banking trojan).",
    "Block the specific outbound C2 IP addresses identified in the network logs."
  ],
  "what_to_avoid": [
    "Do not assume the threat is over just because a scheduled scan quarantined a file; if DarkVNC is active in memory, the attacker is still in control.",
    "Avoid relying solely on file hashes; DarkVNC modules are typically heavily customized and memory-resident."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}