MedusaHVNC Trojan Creates Hidden Desktops to Hijack Browsers and Steal Data

Key Points:

• MedusaHVNC is a remote access trojan (RAT) that utilizes hidden Windows desktops to hijack browsers and steal sensitive data while evading detection.
• The malware impacts systems running Windows and targets browsers like Chrome, Edge, and Firefox, allowing attackers to access live sessions and credentials without the victim's knowledge.
• Recommended actions include blocking the known command server (51.89.204.28:4444) and monitoring for unexpected outbound connections to prevent data exfiltration.

Technical Details: MedusaHVNC employs a multi-layer obfuscation technique, using legitimate Windows features to create hidden desktops for remote control. It executes payloads through an AutoIt interpreter and communicates with its command server via a custom protocol.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1059.001 - Command and Scripting Interpreter: PowerShell (Execution)
• T1027 - Obfuscated Files or Information (Defense Evasion)
• T1041 - Exfiltration Over Command and Control Channel (Exfiltration)

IOCs Mentioned:

• Command Server IP: 51.89.204.28
• Port: 4444

Blocking the identified C2 infrastructure and monitoring for unusual outbound traffic are critical steps for mitigating risks associated with this threat.