Loading story…
Security researchers documented how banking trojans and follow-on intrusion frameworks used reverse VNC backdoors to give operators interactive access to compromised Windows systems. Analysis of IcedID and Qakbot described malware families and backdoor variants including Dark Cat, Anubis, and Keyhole, while a separate Ursnif intrusion showed VNC-enabled hands-on-keyboard activity alongside Cobalt Strike beacons, host and domain discovery, clipboard interaction, and screenshot collection through external image-hosting links.
The reporting also tied these capabilities to real intrusion chains. In the Contact Forms campaign, victims were lured with fake DMCA-themed messages that delivered an ISO containing a shortcut, JavaScript, and DLLs that led to IcedID infection, followed by traffic linked to DarkVNC and multiple Cobalt Strike payloads. Supporting this research, the PCAPeek proof-of-concept was released to reconstruct reverse VNC sessions from packet captures, allowing analysts to recover clipboard files, JPEG frames, and MJPEG video from traffic associated with IcedID and Qakbot backdoors.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
A second Cobalt Strike activity window began on 2021-12-14 at 15:33 UTC and continued through the end of the packet capture at 17:17 UTC. This stage retrieved HI1FA3OB3N7D9.dll over HTTP and generated HTTPS traffic to bqtconsulting.com.
The first observed Cobalt Strike activity began on 2021-12-14 at 06:30 UTC and lasted until 11:55 UTC. This stage retrieved musicbee.dll over HTTP and generated HTTPS traffic to api.musicbee.getlist.destinycraftpe.com.
DarkVNC activity was observed starting on 2021-12-13 at 23:33 UTC following the IcedID infection. The traffic used encoded or encrypted TCP communications to 88.119.161.88 on port 8080.
An infection run tied to the Contact Forms campaign began on 2021-12-13 at 21:45 UTC, using a fake DMCA-themed "Stolen Images Evidence" lure that delivered an ISO file from a Google-hosted URL. When opened, the ISO exposed a shortcut that executed a hidden JavaScript file and DLL, resulting in IcedID infection.
The Contact Forms campaign, which abused website contact forms to send malicious links disguised as legal complaints, had consistently switched from ZIP archives to ISO files by 2021-11-30. The campaign had previously delivered BazarLoader and Sliver before shifting to IcedID.
The Ursnif analysis reported using PCAPeek to reconstruct some of the malware's VNC traffic. This reconstruction enabled recovery of threat actor clipboard data, including screenshot links and admin-panel-related paths and parameters.
A published analysis described an Ursnif intrusion that performed automated host and domain discovery, exfiltrated reconnaissance data, and later used Cobalt Strike beacons for command-and-control. The intrusion also involved hands-on-keyboard activity, VNC-based remote access, and use of LightShot screenshot links hosted on prnt.sc.
A GitHub repository for PCAPeek was published as a proof-of-concept utility to reconstruct reverse VNC traffic from packet captures associated with IcedID and Qakbot VNC backdoors. The tool can output reconstructed clipboard files, JPEG frames, and MJPEG videos, and credits prior research by Brad Duncan and Erik Hjelmvik.
NVISO published research focused on IcedID and Qakbot VNC backdoors under the names Dark Cat, Anubis, and Keyhole. The reference establishes public reporting on these reverse VNC backdoor variants.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 68 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
kostas-ts.medium.com
Open sourcegithub.com
Open sourceblog.nviso.eu
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Multiple incident reports describe **Qakbot** infections delivered through phishing emails that linked to ZIP archives containing malicious Excel files, often using Excel 4.0 macros to fetch DLL payloads. On compromised Windows systems, the malware executed downloaded DLLs with `regsvr32.exe`, contacted multiple command-and-control servers, and in some cases used distribution tags such as **`obama166`** and **`aa`**. Researchers observed Qakbot storing artifacts on disk, changing persistence behavior compared with earlier variants, and in broader campaigns stealing Outlook credentials, adding Windows Defender exclusions, and using internal email threads to spread further inside organizations. Follow-on activity showed operators deploying **Cobalt Strike** and VNC-based remote access, including **DarkVNC** traffic over TCP 443 and VNC beaconing detected after the initial compromise. In one analyzed case, Cobalt Strike and VNC activity appeared about 17 hours after infection, indicating a second-stage intrusion after Qakbot established foothold. Additional reporting ties these intrusions to hands-on-keyboard actions such as reconnaissance, lateral movement over SMB admin shares, service-based persistence, and preparation for ransomware deployment, while one campaign also reportedly abused **PrintNightmare** (`CVE-2021-34527`) for SYSTEM-level execution and may have leveraged **ProxyLogon** and **ProxyShell** to help distribute malicious emails in enterprise environments.
Aug 15, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026