Shadow hVNC Gives Attackers Remote Desktop Control Without Mouse Movement

Threat: Malware

Threat Actor Name: Watchdog

Targeted Region: Global

Alias: Thief Libra

Targeted Sector: Technology & IT

Criticality: High

[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Shadow hVNC creates a second Windows desktop called RemoteXHidden and attaches a worker process to it. An operator can launch a browser, command shell, PowerShell, or another program in that hidden area while the victim sees their desktop. The malware streams screen frames and accepts remote mouse clicks and keystrokes. Its newer Backstage mode can open a browser against the victim’s real profile, allowing the operator to use live cookies and active logins.

Shadow hVNC collects cookies, passwords, autofill details, browser profile data, cryptocurrency wallets, chat sessions, VPN settings, cloud credentials, and recovery-code files. It can inject stolen cookies into a hidden browser session, enabling account reuse without prompting for a password or second factor. The tool also includes an embedded utility named a malicious executable that can capture Windows Local Security Authority process memory when it has administrator rights.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

The malware can copy itself into local application-data folders, register a service disguised as “mouse driver service,” create Run entries and scheduled tasks, and deploy a watchdog called a malicious executable to restore the payload after it is stopped. It also attempts to add security-tool exclusions when elevated.

THREAT PROFILE:

Tactic	Technique Id	Technique	Sub-technique
Persistence	T1547.001	Boot or Logon Autostart Execution	Registry Run Keys / Startup Folder
Defence Evasion	T1036.005	Masquerading	Match Legitimate Resource Name or Location
Credential access	T1555.003	Credentials from Password Stores	Credentials from Web Browsers
Collection	T1005	Data from Local System	-
Command and control	T1071.001	Application Layer Protocol	Web Protocols
Exfiltration	T1041	Exfiltration Over C2 Channel	-

MBC MAPPING:

Objective	Behavior ID	Behavior
Command & Control	B0030	C2 Communication
Impact	B0022	Remote Access
Discovery	E1083	File and Directory Discovery
Persistence	F0012	Registry Run Keys / Startup Folder
Execution	E1204	User Execution
Command & Control	E1105	Ingress Tool Transfer
Defense Evasion	B0029	Polymorphic Code
Anti-Behavioral Analysis	B0003	Dynamic Analysis Evasion