TVRAT and DarkVNC Campaign Infected 80,000 Freelancers — Detection and Defense Guide for SOC Teams

A federal grand jury in California has indicted a Russian national for orchestrating a social engineering campaign that, according to prosecutors, infected roughly 80,000 freelancers with two remote access malware families: TVRAT and DarkVNC. The operation lured freelance workers — designers, developers, virtual assistants, translators — through fraudulent job offers and project-related communications, tricking them into executing malicious payloads that handed persistent remote control of their machines to the operators.

If your first reaction is "we don't employ freelancers," stop and reconsider. Modern enterprises are saturated with contingent labor: contractors on Upwork and Fiverr, offshore development teams, marketing freelancers with access to corporate Google Workspace tenants, and gig workers connecting from unmanaged personal devices into SaaS platforms that hold real corporate data. An infected freelancer's workstation is not a consumer problem — it is a third-party intrusion vector with a live operator on the keyboard. TVRAT and DarkVNC give attackers full interactive access: screen viewing, keystroke capture, file theft, and the ability to operate through the victim's authenticated sessions. Every corporate credential, session cookie, and VPN client on that machine is effectively compromised.

The scale here — 80,000 infections — also tells us something important: this was not a targeted operation against a single vertical. It was an industrial-scale harvesting campaign. Odds are high that credentials and session tokens stolen from these machines are already circulating in access-broker ecosystems. Defenders need to treat this as an identity-and-endpoint problem simultaneously.

Technical Analysis: TVRAT and DarkVNC

The Attack Chain

Based on the indictment reporting and the known operational profile of these malware families, the campaign followed a consistent pattern:

1. Lure delivery — Victims received fraudulent job offers or project invitations, typically through freelance platforms, email, or messaging apps. The lure framed the payload as a legitimate business artifact: a project brief, a "test task," a meeting client, or a required utility.
2. Payload execution — The victim executed a trojanized installer or dropped binary. These payloads are engineered to look benign to casual inspection and frequently arrive without the exploit sophistication of a zero-day — the vulnerability being exploited is trust, not software.
3. RAT deployment — The dropper installed one or both of the remote access components:
   • TVRAT: Malware that abuses TeamViewer infrastructure (or deploys a trojanized TeamViewer component) to establish remote access. Because TeamViewer is legitimate, signed, and widely whitelisted software, TVRAT traffic blends into sanctioned remote-support behavior and sails past perimeter controls that trust the vendor's infrastructure.
   • DarkVNC: A hidden VNC (hVNC-style) backdoor that gives the operator a covert desktop session — screen access and input control that does not visibly disturb the legitimate user. This is the key differentiator from commodity VNC abuse: the victim keeps working while the attacker operates in parallel.
4. Persistence and harvesting — Autorun persistence (registry Run keys, scheduled tasks), followed by theft of browser credentials, cookies, cryptocurrency wallets, files, and live session abuse.

Why This Beats Traditional Controls

Two properties make this combination dangerous in enterprise environments:

• Signed-binary abuse: TeamViewer components are digitally signed and expected on corporate endpoints. Application control policies built on signer trust, and network controls that allow TeamViewer outbound (TCP 5938, with fallback to 443), provide cover for TVRAT. This is the classic LOLRMM (living-off-the-land remote monitoring and management) problem — the same technique class that has driven ransomware intrusions through abused AnyDesk, ScreenConnect, and Atera deployments.
• Hidden session semantics: DarkVNC-style hVNC does not manifest as a visible remote session. There is no obvious screen flicker, no TeamViewer panel, no notification. Detection has to happen at the process, persistence, and network layers — the user will never report it.

Exploitation Status

This is not a theoretical threat. Per the DOJ indictment, the campaign is confirmed active at scale with ~80,000 documented infections. There is no CVE here — no software vulnerability was required. Any detection strategy anchored to vulnerability scanners or patch compliance will see nothing. This is purely a behavioral and configuration-detection problem.

Affected Population

• Freelance and gig-economy workers (primary target)
• Any organization whose contractors, vendors, or employees use personal/unmanaged devices to access corporate SaaS, email, code repositories, or VPN
• Enterprises with permissive RMM policies that allow unapproved remote-access tooling on endpoints

Detection & Response

The detection strategy below targets the observable behaviors of this threat class: remote access tooling executing from non-standard locations, persistence for RAT components, and unauthorized VNC/TeamViewer network activity. These rules are tuned to be useful rather than noisy — every one of them was written to survive contact with a real environment.

Sigma Rules

---
title: Remote Access Tool Execution from User-Writable Path
id: 3f8c2a71-9b44-4e6d-b521-7d0a5f3e9c12
status: experimental
description: Detects TeamViewer, VNC, or similar remote access binaries executing from user-writable directories such as AppData, Temp, or Downloads. TVRAT and DarkVNC payloads dropped via social engineering typically run from these locations rather than legitimate Program Files installations.
references:
  - https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_tools:
    Image|contains:
      - 'teamviewer'
      - 'winvnc'
      - 'tvnserver'
      - 'vncserver'
      - 'ultravnc'
      - 'tightvnc'
      - 'anydesk'
      - 'screenconnect'
  condition: selection_paths and selection_tools
falsepositives:
  - Portable remote support tools run by helpdesk staff from Downloads — whitelist via approved hashes and paths
  - Software developers testing VNC builds locally
level: high
---
title: Remote Access Tool Persistence via Registry Run Key
id: 8e1d5b36-4c7a-42f9-a638-2b9e7d1c5a84
status: experimental
description: Detects persistence entries in registry Run keys referencing TeamViewer, VNC, or unknown binaries in user-writable paths. TVRAT and DarkVNC establish persistence to survive reboots and maintain operator access to infected freelancer workstations.
references:
  - https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
  selection_suspicious:
    Details|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Users\Public\'
      - 'winvnc'
      - 'tvnserver'
      - 'teamviewer'
  filter_legitimate:
    Details|contains:
      - 'C:\\Program Files\\TeamViewer\\TeamViewer.exe'
      - 'C:\\Program Files (x86)\\TeamViewer\\TeamViewer.exe'
  condition: selection_key and selection_suspicious and not filter_legitimate
falsepositives:
  - Legitimate per-user installations of remote support tools — maintain an approved-software inventory to suppress
level: high
---
title: Hidden VNC Listener on Standard Remote Access Ports from Non-System Process
id: 5a92f7c4-1e8b-43d6-b247-9f3a6c8d2e71
status: experimental
description: Detects processes outside standard installation paths establishing or accepting connections on VNC (5900-5910) or TeamViewer (5938) ports. DarkVNC hidden-desktop sessions require outbound or inbound connectivity on VNC protocol ports, and trojanized TeamViewer components communicate over 5938 or HTTPS fallback.
references:
  - https://www.bleepingcomputer.com/news/security/us-charges-russian-for-infecting-80-000-freelancers-with-malware/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 5900
      - 5901
      - 5902
      - 5938
  filter_paths:
    Image|startswith:
      - 'C:\\Program Files\\TeamViewer\\'
      - 'C:\\Program Files (x86)\\TeamViewer\\'
      - 'C:\\Program Files\\uvnc bvba\\'
      - 'C:\\Program Files\\TightVNC\\'
      - 'C:\\Program Files\\RealVNC\\'
  condition: selection_ports and not filter_paths
falsepositives:
  - Approved RMM deployments installed to non-standard paths — tune filters to your managed RMM inventory
  - Internal IT VNC for legacy systems
level: medium

KQL — Microsoft Sentinel / Defender

This query hunts for remote access tooling executing from user-writable locations and correlates it with network activity on VNC/TeamViewer ports. Run it across your full device estate, and pay special attention to hits on contractor-owned or BYOD endpoints enrolled in Defender.

let RmmNames = dynamic(["teamviewer", "winvnc", "tvnserver", "vncserver", "ultravnc", "tightvnc", "anydesk", "screenconnect", "rustdesk", "ammyy"]);
let SuspiciousPaths = dynamic(["\\AppData\\", "\\Downloads\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Temp\\"]);
let RmmPorts = dynamic([5900, 5901, 5902, 5938]);
let ProcHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName has_any (RmmNames)
    | where FolderPath has_any (SuspiciousPaths)
    | project ProcessTime=TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, ProcessId, DeviceId;
let NetHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemotePort in (RmmPorts)
    | where ActionType == "ConnectionSuccess"
    | project NetTime=TimeGenerated, DeviceId, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort, RemoteUrl;
ProcHits
| join kind=leftouter NetHits on DeviceId
| extend AlertReason = strcat("RMM binary '", FileName, "' executed from user-writable path")
| project AlertReason, ProcessTime, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, RemoteIP, RemotePort, RemoteUrl
| order by ProcessTime desc

For environments ingesting Sysmon or Windows events into Sentinel via SecurityEvent, also hunt Event 4688 / Sysmon Event 1 for the same process-name and path combinations, and cross-reference RemoteIP results against threat intelligence feeds — TeamViewer relay infrastructure is legitimate, but DarkVNC operators frequently stand up direct VNC listeners on bulletproof hosting rather than routing through vendor relays.

Velociraptor VQL

Use this artifact during scoping of a suspected compromise — for example, when a contractor reports a suspicious "job offer" attachment or when EDR flags an unauthorized RMM binary. It enumerates running remote-access processes, their listening sockets, and Run-key persistence in a single collection.

-- Hunt for unauthorized remote access tooling: processes, listeners, persistence
LET rmm_regex = '(?i)teamviewer|winvnc|tvnserver|vncserver|ultravnc|tightvnc|anydesk|screenconnect|rustdesk|ammyy'

LET suspicious_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ rmm_regex
  AND NOT Exe =~ '(?i)Program Files'

LET suspicious_listeners = SELECT Pid, Name, Family, Type, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort >= 5900 AND LocalPort <= 5910
   OR LocalPort = 5938
   OR RemotePort = 5938

LET persistence = SELECT FullPath, KeyName, ValueName, ValueData
FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run*', accessor='registry')
WHERE ValueData =~ '(?i)appdata|temp|winvnc|tvnserver|teamviewer'

SELECT * FROM suspicious_procs
UNION ALL
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime FROM suspicious_procs

For triage at scale, split the three LET blocks into separate artifacts — suspicious_procs for live processes, suspicious_listeners for VNC/TeamViewer sockets, and persistence for autoruns — and schedule the persistence artifact as a recurring hunt across your fleet.

Remediation Script

The following PowerShell audits a Windows endpoint for unauthorized remote access tooling, persistence artifacts, and listening VNC ports, then optionally blocks the ports at the host firewall. Run it in audit mode first across your environment to baseline legitimate RMM usage before enabling the block switch.

# TVRAT/DarkVNC endpoint audit and hardening script
# Run as Administrator. Audit mode by default; add -EnforceBlocks to apply firewall rules.
param(
    [switch]$EnforceBlocks
)

$RmmPatterns = 'teamviewer|winvnc|tvnserver|vncserver|ultravnc|tightvnc|anydesk|screenconnect|rustdesk|ammyy'
$ApprovedPaths = @('C:\Program Files\TeamViewer\', 'C:\Program Files (x86)\TeamViewer\')
$Report = @()

# 1. Check for remote access processes running outside approved install paths
Get-Process | Where-Object { $_.Name -match $RmmPatterns } | ForEach-Object {
    $proc = $_
    $path = try { (Get-CimInstance Win32_Process -Filter "ProcessId=$($proc.Id)").ExecutablePath } catch { 'Unknown' }
    $approved = $false
    foreach ($ap in $ApprovedPaths) { if ($path -like "$ap*") { $approved = $true } }
    if (-not $approved) {
        $Report += [pscustomobject]@{
            Finding = 'UNAUTHORIZED_RMM_PROCESS'
            Detail  = "$($proc.Name) (PID $($proc.Id)) running from: $path"
            Severity = 'HIGH'
        }
    }
}

# 2. Audit Run keys for persistence pointing to user-writable paths or RMM binaries
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match $RmmPatterns -and $val -match 'AppData|Temp|Users\\Public') {
                $Report += [pscustomobject]@{
                    Finding = 'SUSPICIOUS_PERSISTENCE'
                    Detail  = "$key -> $($_.Name) = $val"
                    Severity = 'HIGH'
                }
            }
        }
    }
}

# 3. Check for listeners on VNC/TeamViewer ports owned by non-approved processes
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    Where-Object { ($_.LocalPort -ge 5900 -and $_.LocalPort -le 5910) -or $_.LocalPort -eq 5938 } |
    ForEach-Object {
        $owner = try { (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.OwningProcess)").ExecutablePath } catch { 'Unknown' }
        $Report += [pscustomobject]@{
            Finding = 'RMM_LISTENER'
            Detail  = "Port $($_.LocalPort) listening, owner PID $($_.OwningProcess): $owner"
            Severity = 'MEDIUM'
        }
    }

# 4. Optional: block VNC/TeamViewer ports at the host firewall
if ($EnforceBlocks) {
    foreach ($port in @(5900, 5901, 5902, 5938)) {
        $ruleName = "SECARSENAL-Block-RMM-$port"
        if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
            New-NetFirewallRule -DisplayName $ruleName -Direction Inbound -Protocol TCP -LocalPort $port -Action Block | Out-Null
            New-NetFirewallRule -DisplayName "$ruleName-Out" -Direction Outbound -Protocol TCP -RemotePort $port -Action Block | Out-Null
            $Report += [pscustomobject]@{ Finding = 'FIREWALL_RULE_CREATED'; Detail = $ruleName; Severity = 'INFO' }
        }
    }
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path "$env:TEMP\rmm-audit-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv" -NoTypeInformation

Note: the firewall block is a blunt instrument. If your organization legitimately uses TeamViewer for helpdesk support, scope the block to outbound-only on non-helpdesk segments, or restrict TeamViewer outbound traffic at the proxy to approved tenant IDs. Never deploy blocking rules enterprise-wide before the audit phase completes.

Remediation and Hardening

If You Suspect an Infected Endpoint or Contractor

1. Isolate first, image before you clean. hVNC operators burn access the moment they detect response activity. Pull the network connection, acquire memory if feasible (the hidden desktop artifacts live in RAM), then reimage. Cleaning a RAT-compromised machine in place is false economy — you cannot prove the operator did not drop secondary persistence you have not found.
2. Assume total credential compromise for that machine's reach. Every credential, session token, SSH key, browser-stored password, and MFA session accessible from the infected host must be rotated: corporate SSO sessions revoked, cookies invalidated, API keys cycled, VPN credentials reset. The 80,000-victim scale means bulk credential sales are a near-certainty — reset even if you cannot prove theft.
3. Audit downstream access. If the infected party was a contractor, pull their access logs across every system they touched: Git hosting, cloud consoles, ticketing, file shares, email. Look for access consistent with an interactive operator — off-hours sessions, unusual geographies (or residential-proxy patterns), bulk downloads.

Strategic Controls

1. Establish an RMM allowlist and enforce it. Inventory every remote access tool legitimately used in your environment (TeamViewer for helpdesk, ScreenConnect for MSP access, etc.), pin approved versions and install paths, and alert on — then block — everything else. Application control (WDAC/AppLocker) with publisher rules is insufficient alone; TVRAT-style abuse rides legitimate signers, so path and version constraints matter.
2. Constrain egress for remote access protocols. Most endpoints have zero business need for outbound 5900–5910 or 5938. Block by default, permit only from designated support VLANs or jump hosts.
3. Extend your security boundary to contingent labor. Freelancers with access to corporate systems should operate from VDI/jump environments or at minimum through conditional access policies with device compliance requirements. The freelance economy is now a documented, mass-scale intrusion surface.
4. Brief your contractor-facing teams. The lure in this campaign was a fake job offer or project task. Anyone in your organization who onboards freelancers should treat unsolicited executables, "test project" attachments, and "required meeting software" from new contacts as hostile by default.
5. Hunt retroactively. Deploy the Sigma, KQL, and VQL content above against 90 days of historical telemetry. With 80,000 confirmed victims, the probability that some intersect with your extended workforce is not trivial.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub