{
  "family": "hidcon",
  "sample_count": 1,
  "category": "ransomware",
  "description": "HackTool:Win32/Hidcon (Hidden Console) designates utilities designed specifically to execute command-line tools, batch files, or scripts silently, without displaying a visible command prompt (`cmd.exe`) window to the logged-in user. While there are legitimate administrative uses for such tools, threat actors heavily abuse them to execute malicious PowerShell, VBScript, or batch payloads invisibly during post-exploitation (`T1564.003`).<br><br><b>Understanding Hidcon (Execution Evasion)</b><br>To an end-user, the execution is completely invisible—no flashing black boxes. For a SOC analyst, the presence of a Hidcon utility indicates an attacker is actively attempting to evade visual detection while running scripts. It is a 'living off the land' enabler, allowing attackers to use native system tools quietly.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers often drop a small utility (like `hstart.exe` or a custom VBScript wrapper) alongside their primary malicious script. Instead of running `powershell.exe -ExecutionPolicy Bypass -File payload.ps1` directly (which might flash a window), they use the Hidcon tool to launch the script in a hidden, background session (`T1059.001`). This ensures the user does not get suspicious and interrupt the execution of the ransomware encryptor or data exfiltration script.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the script being executed invisibly. Host-based IoCs are centered around process command-line arguments. EDR solutions will log the execution of the Hidcon wrapper, and more importantly, the arguments passed to it (which reveal the true malicious script). Look for unexpected parent-child relationships where an unknown executable spawns `cmd.exe` or `powershell.exe` with arguments designed to hide the window (e.g., `-WindowStyle Hidden`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Hidcon and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hidcon is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hidcon establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hidcon typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Hidcon compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Hidcon should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Hidcon employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hidcon typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Hidcon, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Hidcon depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1564.003",
    "T1059.003",
    "T1059.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1564.003",
      "name": "Hide Artifacts: Hidden Window (The primary function of the tool)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Often the target of the hidden execution)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Executing batch files silently)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Analyze EDR logs to determine exactly which script or command the Hidcon tool was instructed to run.",
    "If the hidden script was malicious (e.g., a reverse shell or encryptor), isolate the machine immediately.",
    "Search the network for the specific script that was executed to identify the scope of the lateral movement.",
    "Implement Application Control (AppLocker) to block the execution of known third-party hidden console utilities."
  ],
  "what_to_avoid": [
    "Do not ignore the alert just because the Hidcon tool itself isn't a virus; the script it executed almost certainly is.",
    "Avoid relying solely on user reports ('I saw a weird black box') to detect script execution, as Hidcon completely bypasses this."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}