Malware

DarkVNC

According to Enigmasoft, DarkVNC malware is a hacking tool that is available for purchase online. it is can be used as a Virtual Network Computing service, which means that the attackers can get full access to the targeted system via this malware. However, unlike a genuine Virtual Network Computing utility, the DarkVNC threat operates in the background silently. Therefore, it is highly likely that the victims may not notice that their systems have been compromised.

Indicators of Compromise 1

Filename msimg32.dll

MITRE ATT&CK TTPs 4

T1027
Obfuscated Files or Information
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1204.002
Malicious File
Execution

Source Articles

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
A Russian national, Searzhudin Tamirlanovich Aktulaev, has been extradited and charged by the U.S. Department of Justice for orchestrating a malware campaign between 2016 and 2017 that targeted users of a major freelance platform. The campaign involved sending malicious Excel attachments that prompted victims to enable macros, which then downloaded either TVRAT (a TeamViewer-based RAT) or DarkVNC malware. These malware variants provided remote access to infected systems and exfiltrated stolen data, including e-commerce credentials and PII, to a U.S.-hosted command-and-control server. The attack exploited DLL search order hijacking to load a malicious msimg32.dll, allowing stealthy persistence and remote control.
hacker-news ·2h ago
US charges Russian for infecting 80,000 freelancers with malware
A Russian national, Searzhudin Tamirlanovich Aktulaev, has been indicted for conducting a phishing campaign between June 2016 and November 2017 that infected approximately 80,000 freelancers with TVRAT and DarkVNC malware. The attacker used 255 fake accounts on a freelance platform to send malicious Excel attachments containing macros, which downloaded malware enabling remote access via TeamViewer and VNC Viewer. The malware exfiltrated stolen data, including e-commerce credentials and personally identifiable information, to command-and-control servers paid for with virtual currency, with thousands of infected systems in the U.S., particularly in the Northern District of California.
bleeping-computer ·2h ago