{ "family": "darkvnc", "sample_count": 3, "category": "ransomware", "description": "HackTool:Win32/Darkvnc is an incredibly dangerous and specialized Remote Access Trojan (RAT) component. It is a highly customized, stealthy implementation of the Virtual Network Computing (VNC) protocol. Unlike legitimate remote administration tools (like TeamViewer or AnyDesk), DarkVNC is designed to establish a *hidden secondary desktop session* (`T1021.005`) on the victim's machine, allowing an attacker full, interactive graphical control without the legitimate user ever knowing they are being watched.

Understanding DarkVNC (Stealth Remote Access)
To an end-user, DarkVNC is completely invisible; their screen does not flicker, and their mouse does not move on its own. For a security analyst, a DarkVNC detection indicates an advanced, active compromise. DarkVNC is rarely distributed on its own; it is almost always a premium module integrated into high-end Banking Trojans (like Trickbot, IcedID, or Ursnif) and Ransomware affiliate toolkits (like Cobalt Strike deployments).

Execution and Hooking Mechanics
Once the primary malware (e.g., IcedID) compromises the system (`T1566.001`), it drops and injects the DarkVNC DLL into a legitimate process (`T1055`). DarkVNC establishes an outbound connection to the C2 server, bypassing inbound firewall rules (`T1105`). When the attacker initiates a session, DarkVNC uses advanced Windows API hooking to create an invisible, secondary desktop environment (`HDESK`). It can capture the screen, inject keystrokes, and interact with banking portals or cryptocurrency wallets directly from the victim's trusted IP address and browser session (`T1539`), completely bypassing geo-fencing and device fingerprinting controls.

Indicators of Compromise & Impact
The impact is total, interactive compromise of the endpoint and the user's active sessions. Network IoCs include persistent, high-bandwidth outbound TCP connections to unknown IP addresses (often over non-standard ports or disguised as HTTPS). Host-based IoCs include EDR alerts for suspicious process injection (especially involving web browsers or `explorer.exe`), the creation of hidden desktop objects in memory, and anomalous API calls related to desktop switching (`SwitchDesktop`).", "cta": "Published by the SystemHelpdesk team.", "aliases": [], "enrichment_level": "expert-seo", "faq": [ { "@type": "Question", "name": "What is Darkvnc and what threat category does it belong to?", "acceptedAnswer": { "@type": "Answer", "text": "Darkvnc is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments." } }, { "@type": "Question", "name": "How does Darkvnc establish persistence and evade defensive controls?", "acceptedAnswer": { "@type": "Answer", "text": "Darkvnc typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks." } }, { "@type": "Question", "name": "What are the essential incident response steps for mitigating a Darkvnc compromise?", "acceptedAnswer": { "@type": "Answer", "text": "Security teams responding to Darkvnc should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups." } }, { "@type": "Question", "name": "What cryptographic algorithms and file targeting techniques does Darkvnc employ during execution?", "acceptedAnswer": { "@type": "Answer", "text": "Darkvnc typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options." } }, { "@type": "Question", "name": "Are decryptors available for Darkvnc, and what is the recommended recovery procedure?", "acceptedAnswer": { "@type": "Answer", "text": "Decryption availability for Darkvnc depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups." } } ], "faq_count": 5, "mitre_attack": [ "T1021.005", "T1539", "T1105", "T1055" ], "cisa_advisory": null, "last_updated": "2026-06-09", "mitre_attack_detail": [ { "id": "T1021.005", "name": "Remote Services: VNC (Hidden Desktop manipulation)", "tactic": "Lateral Movement" }, { "id": "T1055", "name": "Process Injection (Loading the VNC DLL)", "tactic": "Defense Evasion" }, { "id": "T1105", "name": "Ingress Tool Transfer (C2 Communication)", "tactic": "Command and Control" }, { "id": "T1539", "name": "Steal Web Session Cookie (Abusing the trusted browser session)", "tactic": "Credential Access" } ], "containment_steps": [ "Isolate the endpoint IMMEDIATELY; the attacker has active, graphical control and can disable security tools or move laterally.", "Assume all active sessions (banking, email, corporate VPN) on that machine are compromised and immediately revoke those session tokens.", "Perform a deep memory forensic analysis to locate the injected DarkVNC module and identify the parent process (often a banking trojan).", "Block the specific outbound C2 IP addresses identified in the network logs." ], "what_to_avoid": [ "Do not assume the threat is over just because a scheduled scan quarantined a file; if DarkVNC is active in memory, the attacker is still in control.", "Avoid relying solely on file hashes; DarkVNC modules are typically heavily customized and memory-resident." ], "target_industries": [ "Healthcare", "Critical Infrastructure", "Enterprise" ], "motivation": "Financial Extortion", "threat_actors": [ "Unknown / Cybercriminal" ], "target_geographies": [ "Global" ], "attack_stage": [ "defense_evasion", "impact" ], "ecosystem": [ "windows_pe" ], "is_emerging": false, "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }