MedusaHVNC Malware Lets Attackers Remotely Control PCs

Key Takeaways

• MedusaHVNC is a newly identified remote access Trojan (RAT) that enables attackers to operate a hidden virtual desktop on a victim’s PC.
• The malware is distributed as a “malware-as-a-service” offering, making sophisticated hidden VNC (HVNC) capabilities accessible to a wider range of threat actors.
• It leverages a victim’s actual browser profile, cookies, and active sessions, bypassing common fraud detection mechanisms.
• MedusaHVNC incorporates advanced evasion techniques, including in-memory execution, AMSI and ETW bypasses, and living-off-the-land binaries.

MedusaHVNC: A New Threat for Covert PC Control

A recently uncovered remote access Trojan, dubbed MedusaHVNC, allows adversaries to establish a concealed virtual desktop environment on a compromised machine. This stealthy operation enables attackers to load a victim’s authentic browser profiles, complete with cookies and active login sessions, without any visible indication of intrusion to the user.

MedusaHVNC is being marketed and sold as a “malware-as-a-service” through a dedicated website and a Telegram channel. This offering represents a significant advancement in hidden VNC (HVNC) techniques, which have historically been instrumental in banking fraud. The new packaging makes these sophisticated tools readily available for purchase and deployment by a broader spectrum of cybercriminals.

How MedusaHVNC Operates

According to research by BlackFog, this hidden VNC malware establishes an entirely separate Windows desktop environment, complete with its own `explorer.exe` process. This critical feature ensures that the victim’s primary screen remains unaffected and displays no unusual activity, while the attacker maintains full, unobserved control in the background.

A key aspect of MedusaHVNC’s efficacy is its ability to run the hijacked browser directly on the infected computer. By utilizing the victim’s genuine browser profile, session cookies, and stored login credentials, all network traffic appears to originate from a trusted device. This method effectively circumvents many location- and device-based fraud detection systems commonly employed by financial institutions and other online services.

Advanced Features and Evasion

MedusaHVNC is advertised with a “Mem Exec” capability, allowing it to execute .NET and native payloads directly in memory, coupled with built-in AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) bypasses. It also includes a “Browser Recovery” function designed to extract saved passwords, cookies, and browsing history from popular web browsers such such as Chrome, Edge, Brave, and Firefox, as well as the Telegram messaging application.

The malware’s operator panel provides purchasers with a user-friendly interface. From this panel, an attacker can select a specific target application, initiate a hidden desktop session, and even adjust the frame rate and image quality while monitoring a live view of the compromised browser. This level of turnkey criminal tooling aligns with the affiliate models seen in other Medusa-branded malware families.

The infection process typically unfolds in five distinct stages. It begins with the Windows Script Host executing an obfuscated JScript launcher. This launcher then reconstructs hidden components within a temporary folder and establishes a persistence mechanism in the Startup folder, ensuring the malware survives system reboots.

Next, an AutoIt interpreter decrypts the initial native payload using a simple XOR key. This payload is then injected into the legitimate Windows Character Map utility (`charmap.exe`). This “living-off-the-land” technique is a classic evasion strategy, allowing the malware to blend in with trusted system processes, a method also observed in other Medusa-family threats that abuse legitimate tools and signed drivers to avoid detection.

Two additional layers of encryption, employing XOR and ChaCha20 algorithms, are used to unpack the final 64-bit payload. This payload subsequently establishes communication with a hard-coded command-and-control server via raw TCP sockets.

Once fully active, the payload leverages native Windows APIs to control the hidden desktop environment. Its capabilities include:

• Screen and window capture using BitBlt, EnumWindows, and PrintWindow.
• Synthetic input and interaction via SendInput and SetWindowsHookExW.
• Clipboard theft and injection through OpenClipboard, GetClipboardData, and SetClipboardData.
• Targeted support for Chrome, Edge, and Firefox browser sessions.

As detailed in a report shared with CybersecurityNews by BlackFog, MedusaHVNC’s architecture reflects broader trends among Medusa-branded threats. These trends emphasize the use of living-off-the-land binaries, in-memory execution, and legitimate remote-access tools to evade endpoint detection while maintaining persistent, low-visibility access to compromised systems.

What You Should Do

To defend against threats like MedusaHVNC, security teams and users should implement the following mitigation strategies:

• Monitor for unusual child processes originating from `charmap.exe`.
• Detect and investigate any suspicious AutoIt script executions.
• Regularly check the Startup folder for unexpected or unauthorized entries.
• Monitor outbound network connections for activity on uncommon high ports, which could indicate C2 communication.
• Employ advanced endpoint detection and response (EDR) solutions capable of behavioral analysis to identify living-off-the-land attacks and in-memory execution.
• Educate users about phishing and social engineering tactics, as these are common initial vectors for malware delivery.
• Ensure all operating systems, browsers, and security software are kept up to date with the latest patches and definitions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.