30
42
30
30
42
42
42
42
35
30
55
42
30
42
60
30
42
42
30
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.
ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.
55
42
42
42
42
42
30
55
55
30
Dark Caracal Adds New Malware to Cyber Espionage Arsenal
Dark Caracal added GoCaracal, a modular malware framework, expanding its espionage toolkit for data theft and persistent access.
Dark Caracal, a known espionage-focused threat group, has added GoCaracal, a new modular malware framework, to its arsenal. The framework broadens the group's ability to steal victim data and maintain persistent access, according to Dark Reading coverage on 2026-08-26. The addition indicates continued investment in the group's offensive toolset.
48
42
60
47
30
42
30
60
30
30
55