Loading story…
Elastic Security Labs identified LOBSHOT as a malware family that combines credential theft with a hidden virtual network computing capability, allowing attackers to remotely control infected systems through hVNC while remaining invisible to the user. Researchers said the malware’s command-and-control traffic includes hardcoded data that can serve as a hunting signature, giving defenders a way to identify related samples and infrastructure.
Follow-on analysis found code overlap with DarkVNC, although researchers cautioned that the similarity may reflect shared hVNC components rather than firm attribution. Additional triage linked LOBSHOT to more than 550 VirusTotal samples over the prior year, with the earliest identified specimens dating to late July 2022, indicating sustained development and operational use; extracted configurations also revealed multiple C2 IP addresses, most commonly communicating over TCP port 443.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
OpenAnalysis released further technical analysis of LOBSHOT, including code-overlap observations with DarkVNC, a configuration-extraction script, and multiple recovered command-and-control endpoints. The post also noted that Elastic's hardcoded-byte hunting pattern returned more than 550 VirusTotal samples from the prior year.
Elastic Security Labs published its discovery and analysis of the malware family it internally named LOBSHOT. The malware was described as an hVNC-based bot with information-stealing and hidden VNC remote-access capabilities.
OpenAnalysis reported that the earliest samples matching Elastic's cited LOBSHOT hunting pattern appeared in late July 2022, indicating the malware had been active by then.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Shadow hVNC** is being used as a stealthy Windows remote access trojan that creates a hidden desktop, letting attackers interact with an infected system without moving the victim’s visible mouse or exposing on-screen activity. The malware is designed to steal browser cookies, saved passwords, cloud and financial credentials, cryptocurrency wallet data, chat sessions, VPN settings, and session tokens, and it can hijack active browser sessions through a **Backstage** mode that reuses the victim’s real browser profile. Malbear Labs linked a related **Shadow Loader** to malspam campaigns using fake copyright notices aimed at business-page administrators. The latest reported build is a **16.4 MB Go-based payload** with multiple persistence options, including services, `Run` keys, scheduled tasks, and a watchdog process, and it can dump **LSASS** memory when running with administrator privileges. Published indicators and artifacts tie the malware to copied browser databases such as `Login Data.rxcopy`, `Cookies.rxcopy`, and `cookies.sqlite.rxcopy`, along with exfiltration and command-and-control infrastructure including WebSocket and HTTP endpoints and activity associated with `212.162.150.121`. Defenders were advised to isolate affected hosts, hunt for the malware’s file names, mutexes, hidden desktop names, and scheduled tasks, and revoke active sessions rather than relying only on password resets.
Aug 19, 2026
Researchers detailed **MedusaHVNC**, a malware-as-a-service remote access trojan that gives attackers covert control of infected Windows systems by creating an invisible desktop and launching legitimate browsers outside the victim’s view. The malware lets operators abuse the victim’s existing browser profiles, cookies, and live authenticated sessions, making malicious activity appear to come from the user’s own device. Analysts said the payload supports typical hidden VNC functions including screen capture, synthetic keyboard and mouse input, window interaction, and clipboard access, with references to **Chrome**, **Edge**, and **Firefox**. Analysis of a recent sample found a five-stage infection chain starting with `wscript.exe` running an obfuscated JScript launcher, followed by files dropped into the **TEMP** directory, persistence via a **Startup**-folder batch file, and AutoIt-based components that inject a loader into `charmap.exe` before unpacking the final unsigned 64-bit payload. The malware contains the **MedusaHVNC** family string and communicates over a custom TCP protocol with a hard-coded command-and-control server at `51.89.204.28:4444`. Researchers said defenders should focus on outbound traffic monitoring, blocking known infrastructure and file hashes, and watching for unexpected data exfiltration because stolen information must still leave the network.
Jul 29, 2026
Researchers have identified **STX RAT**, a newly observed remote access trojan that pairs credential theft with **hidden virtual network computing (HVNC)** to let attackers control infected Windows systems without visible on-screen activity. The malware was seen in early 2026 delivered through a browser-downloaded VBScript chain that launched JScript, fetched a TAR archive, and used a PowerShell loader for in-memory injection; a separate campaign used trojanized **FileZilla** installers. Analysis found anti-analysis checks for **VirtualBox**, **VMware**, and **QEMU**, along with a random-delay “jitter exit” and an **AMSI ghosting** technique that patches a Windows RPC function to reduce detection. STX RAT communicates with command-and-control infrastructure at `95.216.51.236` using **X25519 ECDH** and **ChaCha20-Poly1305** encryption, then exfiltrates host information, screenshots, and credentials from tools including **FileZilla**, **WinSCP**, and **Cyberduck**. Its HVNC capability is considered the most dangerous feature because it creates invisible desktop sessions that allow attackers to interact with the victim machine covertly. Defenders were urged to block the known C2 IP and associated Tor onion infrastructure, monitor suspicious **WScript** and **PowerShell** activity, apply available **YARA** detections, and disable **VBScript** and **JScript** where operationally possible.
Jun 29, 2026