ScanMalware.com
Known malicious kitcriticalstealer

ShadowHVNC ('Bridge') hidden-VNC and stealer kit: operator panel

family: shadowhvnc-bridge-panel-2026-10
Short link:scanmalware.com/h/321

Operator panel of ShadowHVNC, a remote-access and information-stealing kit sold under a licence, whose builds call themselves 'Bridge'. Infected Windows machines run a Rust agent ('BridgeAgent') that gives the operator a hidden desktop (hidden VNC) to use the victim's browser out of sight, a remote terminal, file and software push (executables, MSI packages, PowerShell and batch scripts) and a 'forensics' collector that captures text from the machine; the operator is alerted over Telegram. The panel is a single-page web console disguised as endpoint-management software ('Secure endpoint orchestration', 'fleet console') in English, Russian and Chinese. It is served over HTTPS on bare IP addresses with a self-signed certificate issued by 'Bridge Agent Control Runtime Root CA', or behind a domain with an ordinary certificate. The current login page is titled 'Shadow HVNC / Stealer v7' and shows 'Shadow 7.0'; the 6.1 build showed a licence-key and machine-ID gate. This hunt matches the panel by its page code, and tracks the panel certificate, the page title and known panel addresses.

Anchors

YARA ruleShadowHVNC_Bridge_Panel
SMQL queryrun
cert_issuer:"Bridge Agent Control Runtime Root CA" OR title:"Shadow HVNC" OR contacted_host:p.statrelay.net OR ip:45.63.5.163 OR ip:94.26.0.107 OR ip:96.62.224.138 OR ip:167.148.195.48 OR ip:96.62.224.240 OR ip:93.152.213.149 OR ip:93.152.223.169 OR ip:91.92.34.93 OR ip:2.27.160.149 OR ip:176.65.144.78 OR ip:45.86.61.186 OR ip:216.158.94.75 OR ip:167.148.195.53

Provenance

Added: 2026-10-29 22:04
Panels answering in late October 2026: 45[.]63[.]5[.]163, 94[.]26[.]0[.]107, 96[.]62[.]224[.]138 and p[.]statrelay[.]net (167[.]148[.]195[.]48), all on the same build. Further panel addresses reported publicly for the same kit: 96[.]62[.]224[.]240, 93[.]152[.]213[.]149, 93[.]152[.]223[.]169, 91[.]92[.]34[.]93 (helvetitech[.]site), 2[.]27[.]160[.]149, 176[.]65[.]144[.]78, 45[.]86[.]61[.]186, 216[.]158[.]94[.]75 and 167[.]148[.]195[.]53. Server addresses are rented and get reassigned, so a later scan of one of these addresses is a lead, not proof; the page-code match is the reliable signal. The agent sample jakone.bin (SHA-256 aea291ecbfc916acb6cd8b1d1f9a3671c8782c5bc051098c7ab9d94c786d5dcc, publicly labelled BridgeAgent) was staged in an open storage bucket on 107[.]175[.]82[.]242 that also serves other malware families, so that address is deliberately not tracked here. bkrvmdtcm[.]com, listed alongside these panels, was reported separately as a NetSupport RAT server and is not included.
References:

Sightings (11)Atom feed

HostScanScriptMatchScanned
96.62.224.13857f0344f…—query2026-10-29 22:17
96.62.224.13857f0344f…https://96.62.224.138/#htmlyara2026-10-29 22:17
96.62.224.13857f0344f…https://96.62.224.138/yara2026-10-29 22:17
p.statrelay.neta0cdf504…https://p.statrelay.net/#htmlyara2026-10-29 21:47
p.statrelay.neta0cdf504…—query2026-10-29 21:47
96.62.224.138c43d2b2a…https://96.62.224.138/#htmlyara2026-10-29 21:47
96.62.224.138c43d2b2a…—query2026-10-29 21:47
94.26.0.107cb57a4b3…https://94.26.0.107/#htmlyara2026-10-29 21:47
94.26.0.107cb57a4b3…—query2026-10-29 21:47
45.63.5.163404794e1…https://45.63.5.163/#htmlyara2026-10-29 21:47
45.63.5.163404794e1…—query2026-10-29 21:47