MedusaHVNC RAT Uses Hidden Desktop to Steal Sensitive Data

The article discusses MedusaHVNC, a remote access trojan (RAT) marketed as malware-as-a-service (MaaS), which operates from a hidden Windows desktop to evade user detection. MedusaHVNC employs a 5-stage infection process beginning with a JScript launcher that writes files to the system and maintains persistence through Startup folder entries.

It utilizes Windows AutoIT for payload decryption and incorporates complex encryption methods such as XOR and ChaCha20 for secure communication with a command and control server. The malware allows attackers to interact with the hidden desktop using legitimate Windows functions and capture data via various inputs. The primary mitigation strategy involves monitoring for unusual data exfiltration from the network.