Cybersecurity researchers have identified a sophisticated remote access tool known as Shadow hVNC, which allows attackers to control a victim’s computer without any visible signs. Unlike traditional remote desktop tools that take over the user’s active session, Shadow hVNC creates a hidden Windows desktop environment, enabling malicious actors to operate discreetly.
Once installed, Shadow hVNC establishes a concealed workspace named ‘RemoteXHidden.’ Within this environment, attackers can launch applications such as web browsers, command shells, or PowerShell instances, all while the victim remains unaware. The malware streams screen frames and processes remote inputs, facilitating seamless control over the compromised system.
A particularly concerning feature is the ‘Backstage’ mode, which grants attackers access to the victim’s real browser profile. This capability allows them to exploit active sessions and cookies, potentially bypassing authentication mechanisms and gaining unauthorized access to sensitive accounts, including banking and corporate services.
In instances where creating a hidden desktop is not feasible, Shadow hVNC employs alternative methods to maintain control. It can disable the victim’s keyboard and mouse inputs and turn off the physical monitor, creating the illusion that the computer is inactive. Meanwhile, the attacker continues operations in the background. Additionally, the malware can forcibly terminate the Chrome browser process to hijack the user’s browser profile, further facilitating unauthorized access.
Shadow hVNC is equipped with extensive data collection capabilities. It can harvest browser cookies, saved passwords, autofill information, cryptocurrency wallets, chat sessions, VPN configurations, cloud service credentials, and recovery codes. By injecting stolen cookies into hidden browser sessions, attackers can access accounts without triggering password prompts or multi-factor authentication challenges.
The malware also includes an embedded utility named ‘lss.exe,’ which, when executed with administrative privileges, can extract memory from the Windows Local Security Authority Subsystem Service (LSASS). This process may yield credentials that attackers can use to escalate privileges and move laterally within an organization’s network.
To ensure persistence, Shadow hVNC employs several techniques. It copies itself into local application data folders, registers a service disguised as a ‘mouse driver service,’ creates registry entries and scheduled tasks, and deploys a watchdog process named ‘WmiPrvSE.exe’ to restore the malware if it is terminated. Additionally, it attempts to add exclusions to security tools when operating with elevated privileges.
Organizations should be vigilant for indicators of compromise associated with Shadow hVNC. Signs include the presence of hidden desktops, browser database copies with ‘.rxcopy’ extensions, profile-staging folders under the ‘RemoteX’ path, unexpected scheduled tasks, new registry run values, changes to security exclusions, and processes terminating browsers they did not initiate.
In response to potential infections, it is crucial to isolate affected devices, preserve relevant logs, reset exposed sessions and credentials, and review administrative access. Given that stolen browser cookies can circumvent multi-factor authentication, revoking active sessions is essential, not merely changing passwords.
The emergence of Shadow hVNC underscores the evolving sophistication of cyber threats. Its ability to operate invisibly and exploit active sessions poses significant risks to both individuals and organizations. Proactive monitoring, robust endpoint protection, and user education are vital components in defending against such advanced malware.
