Hidden Desktop (often referred to as HVNC) is a tool that allows operators to interact with a remote desktop session without the user knowing. The VNC protocol is not involved, but the result is a similar experience. This Cobalt Strike BOF implementation was created as an alternative to TinyNuke/forks that are written in C++.

There are four components of Hidden Desktop:

BOF initializer: Small program responsible for injecting the HVNC code into the Beacon process.

HVNC shellcode: PIC implementation of TinyNuke HVNC.

Server and operator UI: Server that listens for connections from the HVNC shellcode and a UI that allows the operator to interact with the remote desktop. Currently only supports Windows.

Application launcher BOFs: Set of Beacon Object Files that execute applications in the new desktop.