🧰 TightVNC

The items that name it 3

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas affected products2026-09-28

  Legitimate open-source software abused via DLL sideloading (vim64.dll path under TightVNC directory)

• Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
  writeupas affected products2026-05-07

  VNC clone referenced in a Registry (.reg) file bundled with the installer, set to run even in Windows Safe Mode with a nonstandard install path C:\PeopleOne\dependencies\tightvnc\tvnserver.exe -service; not actually observed being installed

• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas tools2025-12-03

  Open-source remote desktop software installed by the threat actor in Incident 3 to facilitate expanded access