57
30
30
30
57
45
60
45
57
57
57
42
30
30
60
57
30
45
57
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.
ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.
55
October 2025 CVE Landscape
60
60
60
57
60
60
60
47
60
30
60
60
30
60
30
60
30
57
60
30