MedusaHVNC Steals Live Windows Sessions Through a Hidden Desktop

Summary

MedusaHVNC is a newly identified Remote Access Trojan (RAT) distributed through a Malware-as-a-Service (MaaS) model. It uses a hidden Virtual Network Computing (HVNC) module to create a separate and invisible Windows desktop session. This enables attackers to hijack active browser sessions, including cookies and authenticated session states, without alerting the victim.

Investigation

Researchers analyzed a MedusaHVNC sample and uncovered a five-stage infection chain beginning with an obfuscated JScript launcher. The investigation showed that AutoIt is used for decryption and process injection into the legitimate Windows Character Map utility (charmap.exe). The final payload relies on ChaCha20 encryption and communicates with a hard-coded C2 server over a custom TCP protocol.

Mitigation

Effective mitigation includes blocking known C2 infrastructure and monitoring endpoints for unusual outbound network connections. Organizations should deploy anti-data exfiltration controls capable of inspecting outbound traffic regardless of the originating process. Monitoring for suspicious child processes or injection activity involving legitimate system binaries such as charmap.exe can also improve detection.

Response

If MedusaHVNC activity is detected, security teams should immediately isolate the affected endpoint to terminate communication with the C2 server. Investigators should identify the initial delivery path of the JScript launcher and check for persistence mechanisms in the Startup folder. Session and authentication logs should also be reviewed for unauthorized activity occurring during the compromise window.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has successfully deployed MedusaHVNC on a victim workstation. To establish command and control (C2) and begin remote desktop interaction, the malware attempts to reach out to its hard-coded listener. In this simulation, we mimic this behavior by forcing a connection to a local listener on port 4444. This action is intended to simulate the “Phone Home” phase of the MedusaHVNC lifecycle, generating a Sysmon Event ID 3 log with DestinationPort: 4444.

• Regression Test Script:

  # Simulation Script: MedusaHVNC C2 Communication Emulation
  # Goal: Generate a network connection event on port 4444 to trigger the Sigma rule.
  
  $TargetIP = "127.0.0.1"
  $TargetPort = 4444
  
  Write-Host "[+] Starting MedusaHVNC C2 Simulation..." -ForegroundColor Cyan
  
  # Step 1: Create a local listener to catch the connection (Simulates C2 Server)
  $Listener = New-Object System.Net.Sockets.TcpListener([System.Net.IPAddress]::Loopback, $TargetPort)
  $Listener.Start()
  Write-Host "[+] Local C2 listener started on $TargetIP:$TargetPort" -ForegroundColor Green
  
  try {
      # Step 2: Emulate the malware's outbound connection
      Write-Host "[+] Emulating outbound connection to C2..." -ForegroundColor Yellow
      $Client = New-Object System.Net.Sockets.TcpClient
      $Client.Connect($TargetIP, $TargetPort)
      Write-Host "[!] Success: Connection established. Check SIEM for alerts." -ForegroundColor Red
  }
  catch {
      Write-Host "[-] Failed to connect: $($_.Exception.Message)" -ForegroundColor Red
  }
  finally {
      # Cleanup connection
      if ($Client) { $Client.Close() }
      $Listener.Stop()
      Write-Host "[+] Simulation cleanup complete." -ForegroundColor Cyan
  }

• Cleanup Commands:

  # Ensure no lingering processes or listeners exist
  Stop-Process -Name "powershell" -Force -ErrorAction SilentlyContinue
  # (Note: In a real environment, manually verify port 4444 is closed)
  Test-NetConnection -ComputerName 127.0.0.1 -Port 4444