HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.
ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.
- Fake DocuSign/NFe pages run anti-bot checks and return base64-encoded ZIP payloads via JSON.
- LNK dropper executes hidden PowerShell; NSIS loader bundles the final 64-bit backdoor.
- Backdoor offers HVNC hidden desktop control, keylogging, and Firefox cookie theft.
- Startup-folder persistence plus EDR/AV process checks; C2 over TCP/27015 via GHOSTnet GmbH.
- Tradecraft resembles Silver Fox / Winos4.0 at medium confidence; attribution unconfirmed.
- Products
- HVNC backdoorFirefox
- Threat actors
- Silver FoxWinos4.0
- Malware
- HVNC backdoor
- Countries
- Brazil
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gerenciadorcaixa.digital | letely separate banking-phishing cluster A related domain — gerenciadorcaixa.digital, cloning Caixa Econômica Federal’s corporate banking portal |
| ipv4 | 5.230.249.49 | : 02 19 05 04 07 19 05 03 0E 19 03 0E XOR key: 0x37 Result: 5.230.249.49 The destination port is stored in plaintext: 27015 – the de |
From the original article
12 min read at any.run
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X. Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access.
By Moises Cerqueira (0xOlympus) · any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.