{"id":22995,"date":"2026-09-08T10:24:30","date_gmt":"2026-09-08T10:24:30","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=22995"},"modified":"2026-09-08T10:32:29","modified_gmt":"2026-09-08T10:32:29","slug":"hvnc-backdoor-targets-latam","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/hvnc-backdoor-targets-latam\/","title":{"rendered":"HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures"},"content":{"rendered":"\n

Editor\u2019s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn<\/a> and X<\/a>.<\/em><\/p>\n\n\n\n

Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots.<\/p>\n\n\n\n

The attack chain combines trusted business lures, anti-analysis techniques, and infrastructure designed to keep access hidden. For security leaders, the risk goes beyond a single compromised endpoint: persistent access can expose credentials, sensitive data, and business systems while giving attackers more time to move deeper into the environment.<\/p>\n\n\n\n

HVNC Campaign Overview<\/h2>\n\n\n\n

The campaign uses fake DocuSign notifications, NFe tax documents, and banking-themed phishing to deliver a custom HVNC backdoor. Once installed, it can give attackers hidden remote control and persistent access to compromised systems.<\/p>\n\n\n\n

\n \n\n \n \n \n \n \n
\n Threat type <\/td>\n \n Multi-stage phishing campaign; custom HVNC backdoor <\/td>\n <\/tr>\n
\n Targeting <\/td>\n \n Banking and financial services in Latin America <\/td>\n <\/tr>\n
\n Delivery <\/td>\n \n Fake DocuSign and NFe tax-document lures; related ClickFix-style delivery also observed <\/td>\n <\/tr>\n
\n Objective <\/td>\n \n Persistent remote access and control of compromised systems <\/td>\n <\/tr>\n
\n Attribution <\/td>\n \n Unconfirmed; Silver Fox \/ Winos4.0-adjacent tradecraft at medium confidence <\/td>\n <\/tr>\n <\/table>\n<\/div>