UltraVNC
UltraVNC is an open-source remote access and remote administration utility that has been repeatedly abused by threat actors as a RAT or secondary access tool. The provided content describes it being delivered in multi-stage phishing and intrusion chains, including campaigns that downloaded and executed off-the-shelf payloads such as UltraVNC alongside other malware. It was used by the Awaken Likho APT campaign, active since at least July 2021, which primarily targeted Russian government organizations and contractors; in May 2024, Awaken Likho disguised UltraVNC as a OneDrive update utility, and in June 2024 some samples switched from UltraVNC to MeshAgent. The content also notes Gamaredon tooling has included remote management capability via UltraVNC in campaigns historically focused on Ukrainian entities, and that manipulated UltraVNC programs were deployed in some operations. In a supply-chain attack investigated by Mandiant and attributed to DARKSIDE affiliate UNC2465, attackers used PowerShell to download the UltraVNC application renamed as winvnc.exe together with UltraVNC.ini, established persistence via registry Run keys and shortcut modifications, and used UltraVNC for remote access after compromise through Trojanized CCTV software installers. In that UNC2465 activity, UltraVNC was configured to connect to 81.91.177[.]54:7234. Across the cited reporting, UltraVNC appears as a legitimate tool repurposed for malicious remote access, often delivered through phishing, staged loaders, or Trojanized software, and used in espionage and ransomware-affiliate intrusions.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These attachments relied on a multi-stage execution chain, often using up to three nested stages, to download and execute off-the-shelf payloads like Remote Manipulator System (RMS) RAT, a tool widely shared on Russian hacker forums, or UltraVNC, an open-source remote access utility.
“deploying two types of payloads. The first is a manipulated Ultra VNC program…”
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Historically, according to the 2015 LookingGlass report Operation Armageddon: Cyber Espionage as a Strategic Component of Russian Modern Warfare, Gamaredon conducted spearphishing campaigns using stolen, highly relevant decoy documents of mimicking Ukrainian institutions to target government entities.
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Lateral Movement
2 techniques
Lateral Movement
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source remote access utility used as an off-the-shelf payload in early Gamaredon intrusion chains.
UltraVNC is a legitimate remote access tool that was abused by the attacker to maintain remote desktop access to compromised systems. It was configured for persistence and used in conjunction with NGROK for external access.
Legitimate remote administration tool observed as a manipulated payload in Lazarus-linked activity; also referenced as used within Gamaredon’s toolkit.
Legitimate remote access tool referenced as a RAT in Italian-language campaigns.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.