{
  "family": "tinynuke",
  "sample_count": 19,
  "category": "trojan",
  "description": "Trojan:Win32/TinyNuke (also known as NukeBot) is an advanced, highly capable banking trojan whose source code was leaked online, leading to widespread proliferation. Strongly influenced by the infamous Zeus trojan, TinyNuke is designed to perform Man-in-the-Browser (MitB) attacks, intercept credentials, and most notably, provide attackers with Hidden VNC (hVNC) access to compromised machines.<br><br><b>Understanding TinyNuke</b><br>To the victim, TinyNuke is invisible until their bank account is drained or unauthorized transactions occur. For security analysts, TinyNuke is a tier-one financial threat. Its most dangerous feature is its custom hVNC module. Unlike standard remote desktop tools that lock the user out, hVNC creates a hidden, secondary desktop session on the infected machine. This allows the attacker to open a browser and perform banking transactions from the victim's actual IP address and device, completely bypassing banking fraud detection systems that look for unrecognized devices.<br><br><b>Execution and Web Injects</b><br>TinyNuke is distributed via phishing campaigns (`T1566.001`) or exploit kits. Upon execution, it achieves persistence via Registry Run keys. It relies heavily on DLL injection, injecting its payload into `explorer.exe` or web browser processes (`T1055.001`). When the user navigates to a targeted financial site, TinyNuke pulls web inject configurations from its C2 server. It intercepts the browser's API calls (`T1185`) to inject malicious HTML/JavaScript directly into the banking page (`T1111`), stealing credentials before they are encrypted. The hVNC module communicates with the C2, allowing the attacker to silently shadow the user's session.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud. EDR platforms must alert on the injection of unsigned DLLs into `explorer.exe` or browser processes. Network logs will reveal encrypted HTTP traffic to C2 servers, often utilizing DGA (Domain Generation Algorithms) or fast-flux networks. A key indicator of the hVNC module is the anomalous creation of hidden desktop objects within the Windows session.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1111",
    "T1185",
    "T1133",
    "T1055.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Man-in-the-Browser",
      "tactic": "Collection"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1133",
      "name": "External Remote Services (hVNC)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; the attacker has active, real-time control over the user's web browser sessions via the hVNC module.",
    "Initiate a mandatory password reset for all financial and corporate accounts accessed from the infected machine, utilizing a known-clean device.",
    "Capture a forensic memory image (RAM dump) to extract the decrypted web inject configurations and identify which specific banking portals were targeted.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force the revocation of any session tokens or cookies stored on the machine."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any sensitive portal to 'check their balance'; the MitB trojan will intercept the login and modify the displayed balance.",
    "Avoid relying solely on basic antivirus scans; the hVNC module operates deep within system memory and requires a full system wipe to guarantee eradication."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}