Threat reportMalwareTL-2026-1733
MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass and Multi-Browser Session Hijacking
MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass (TL-2026-1733) is a high-severity malware campaign, first published 2026-07-27. It has no confirmed attribution, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1005, T1010, T1027), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1733
- Threat ID
- TL-2026-1733
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass
Malware and tooling: MedusaHVNC, MedusaHVNC MaaS panel, AutoIt, Browser Recovery, MedusaHVNC custom raw-TCP protocol, Mem Exec
How MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass works
MedusaHVNC is a malware-as-a-service remote access Trojan that opens a hidden virtual desktop on Windows systems via a second explorer.exe process, then hijacks the victim's real browser profile and session cookies to extract saved passwords, cookies, and history from Chrome, Edge, Brave, Firefox, and Telegram, while using AMSI/ETW bypasses and in-memory execution to evade detection.
MedusaHVNC, documented by BlackFog researchers and reported by CybersecurityNews and SecurityWeek on 2026-07-27, is a hidden virtual network computing (HVNC) remote access Trojan sold as malware-as-a-service through a dedicated storefront website and a Telegram distribution channel. Its defining capability is spinning up a completely separate Windows desktop session with its own explorer.exe process; the operator opens a real browser (Chrome, Edge, or Firefox) on that hidden desktop using the victim's actual browser profile, so the session rides the victim's live authenticated cookies and appears as ordinary user traffic to the destination site, while the victim's visible screen shows nothing unusual.
Infection proceeds through a five-stage chain. Stage 1: the legitimate Windows Script Host (wscript.exe) executes an obfuscated JScript launcher that waits roughly 7,584 milliseconds before building its components in a randomly-named staging directory under %TEMP%\Nx2981Okkr2\. Stage 2: the launcher drops a renamed AutoIt interpreter (eepcxlhgdz.exe), an extensionless encrypted payload blob (zorsxklxfehdoals), and a batch file (AFLlvOscPj.bat) written to the Startup folder for persistence. Stage 3: the AutoIt interpreter decrypts the staged payload with a single-byte XOR key (0xAE), producing the first native 64-bit executable. Stage 4: that stage injects into a spawned instance of the legitimate Windows Character Map utility (charmap.exe), hosting the remainder of the payload under a trusted process identity to blend in with normal system activity. Stage 5: the injected code unpacks the final payload through two additional encryption layers — a 16-byte repeating-key XOR pass over 1,009,152 bytes of the .data section, followed by ChaCha20 decryption (32-byte key, 12-byte nonce, counter value 1) of 998,912 bytes — yielding an unsigned PE32+ x86-64 console executable containing a distinguishing .pay section and an embedded 'MedusaHVNC' family string.
The final payload communicates over a custom protocol built directly on native Winsock calls (WSAStartup, socket, connect, send, recv) — not an application-layer protocol like HTTP/HTTPS — to a hardcoded command-and-control server at 51.89.204.28 on TCP port 4444. Advertised operator features include 'Mem Exec' (in-memory execution of .NET and native payloads combined with an AMSI patch and an ETW bypass) and 'Browser Recovery' (extraction of saved passwords, cookies, and browsing history from Chrome, Edge, Brave, Firefox, and Telegram). Within the hidden desktop, the malware supports screen and window capture (BitBlt, EnumWindows, PrintWindow), synthetic input injection (SendInput, SetWindowsHookExW), and clipboard theft/manipulation (OpenClipboard, GetClipboardData, SetClipboardData). Neither BlackFog's writeup, SecurityWeek's coverage, nor CybersecurityNews's coverage disclosed file hashes, additional C2 infrastructure beyond the single hardcoded IP, a specific threat-actor name/alias, or a MaaS price list; a BeaconBeagle correlation check against 51.89.204.28 returned no existing beacon/config match as of 2026-07-27, indicating this C2 endpoint is not yet present in that index. No CVE applies — this is a crimeware delivery/evasion technique set, not a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1733
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking
Discovery
T1010 Application Window Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1095 Non-Application Layer Protocol; T1219 Remote Access Tools; T1571 Non-Standard Port
credential-access
T1539 Steal Web Session Cookie
Persistence
T1547 Boot or Logon Autostart Execution
Credential Access
T1555 Credentials from Password Stores
defense-impairment
Affected products and versions in MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass
- Microsoft — Windows
Vulnerable versions: Windows 10/11 and Windows Server hosts with charmap.exe present (x86-64) - Google — Chrome
Vulnerable versions: All versions — targeted locally by the Browser Recovery module and hidden-desktop session hijacking - Microsoft — Edge
Vulnerable versions: All versions — targeted locally by the Browser Recovery module and hidden-desktop session hijacking - Brave Software — Brave Browser
Vulnerable versions: All versions — targeted locally by the Browser Recovery module - Mozilla — Firefox
Vulnerable versions: All versions — targeted locally by the Browser Recovery module and hidden-desktop session hijacking - Telegram FZ-LLC — Telegram Desktop
Vulnerable versions: All versions — session/data theft via the Browser Recovery module
Remediation for MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass
Patches
- No vendor patch applies — MedusaHVNC is a malware-as-a-service delivery/evasion toolkit, not a software vulnerability
Immediate actions
- Block outbound network traffic to C2 server 51.89.204.28:4444 at the perimeter and on endpoint firewalls
- Hunt for unexpected child processes or injected threads under charmap.exe across the Windows fleet
- Hunt for wscript.exe executing JScript launchers with anomalous multi-second sleep delays before writing files under %TEMP%
- Inspect Startup folder entries for unrecognized .bat files added outside change-management windows
Workarounds
- Disable or restrict Windows Script Host (wscript.exe) execution for standard users via AppLocker/WDAC
- Block egress to non-standard high TCP ports (e.g., 4444) from endpoint subnets where not required
- Alert on any secondary interactive Windows desktop/session creation (Winsta0-adjacent hidden desktops)
Longer-term hardening
- Deploy EDR with behavioral detection for process injection into trusted Windows utilities (charmap.exe, mmc.exe, etc.)
- Enforce application allowlisting/constrained language mode to block unauthorized AutoIt interpreter execution
- Monitor for AMSI-bypass and ETW-tampering patterns (AmsiScanBuffer patching, EtwEventWrite hooking) via EDR telemetry
- Force browser session re-authentication / short-lived session tokens to reduce the value of stolen live cookies
- Restrict or log Windows Script Host (wscript.exe/cscript.exe) execution via GPO where not operationally required
Timeline of MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass
- SecurityWeek and CybersecurityNews independently publish coverage of BlackFog's MedusaHVNC research the same day.
- Final payload establishes a custom raw-TCP C2 channel to hardcoded server 51.89.204.28:4444 using native Winsock calls.
- Final payload is unpacked via a 16-byte repeating-key XOR pass over 1,009,152 bytes followed by ChaCha20 decryption (32-byte key, 12-byte nonce, counter=1) of 998,912 bytes, yielding an unsigned PE32+ x86-64 binary with a .pay section.
- Decrypted stage injects into a spawned charmap.exe (Windows Character Map) process to host the next payload under a trusted process identity.
- AutoIt interpreter decrypts the staged payload with a single-byte XOR key (0xAE), producing the first native 64-bit executable stage.
- Launcher drops the AutoIt interpreter (eepcxlhgdz.exe), an encrypted payload blob (zorsxklxfehdoals), and a Startup-folder batch file (AFLlvOscPj.bat) for persistence.
- Infection begins when wscript.exe executes an obfuscated JScript launcher that waits ~7,584 ms before staging components under %TEMP%\Nx2981Okkr2\.
- BlackFog researchers publish the first public technical analysis of MedusaHVNC, documenting its hidden-virtual-desktop architecture and infection chain.
- MedusaHVNC RAT is observed actively distributed via a dedicated malware-as-a-service storefront website and a Telegram channel, per BlackFog telemetry.
Sources cited for MedusaHVNC — Hidden Virtual Desktop RAT with AMSI/ETW Bypass
- MedusaHVNC — A Hidden Desktop
- Hackers Can Use MedusaHVNC to Control Your PC on a Desktop You Cannot See
- MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection
- MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection (mirror)
- MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection (mirror)
- BeaconBeagle C2 infrastructure correlation check — 51.89.204.28 (no match)
Detection coverage for TL-2026-1733
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1733 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.