HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

MITRE Techniques

• [T1592 ] Gather Victim Host Information – The lure page fingerprints the visitor before delivery, collecting browser and system details (‘silent background request also fingerprints the visitor’s browser, OS, timezone and screen size’).
• [T1566.002 ] Phishing: Spearphishing Link – The attack begins with a fake DocuSign notification and NFe tax-document page (‘Fake DocuSign and NFe delivery-notice page as the entry vector’).
• [T1027 ] Obfuscated Files or Information – The campaign uses ZIP-in-disguise delivery and XOR-obfuscated configuration (‘nested single-byte XOR string obfuscation with context-specific keys’).
• [T1036.005 ] Masquerading: Match Legitimate Name or Location – The malware pretends to be legitimate software and documents (‘UpdateAssistant.exe claims Microsoft Corporation while unsigned’).
• [T1518.001 ] Security Software Discovery – The backdoor checks for more than 20 AV/EDR processes to adjust behavior (’20+ hardcoded AV/EDR process names’).
• [T1204.002 ] User Execution: Malicious File – The victim must open the disguised LNK shortcut to start execution (‘Victim double-clicks the disguised .lnk’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – A hidden PowerShell one-liner downloads the second stage (‘Hidden, execution-policy-bypassed PowerShell one-liner’).
• [T1105 ] Ingress Tool Transfer – PowerShell retrieves the loader from staging infrastructure (‘Invoke-WebRequest pulling the NSIS loader from the Azure staging host’).
• [T1573 ] Encrypted/Obfuscated Configuration – The C2 host is stored as XOR-protected bytes inside the payload (‘XOR-protected C2 host string embedded in the final payload’).
• [T1571 ] Non-Standard Port – The malware communicates over TCP/27015 or 27017 instead of web protocols (‘Raw TCP C2 on port 27015’).
• [T1095 ] Non-Application Layer Protocol – The backdoor uses a custom raw-TCP protocol for operator communication (‘Custom raw-TCP protocol rather than HTTP/WebSocket’).
• [T1113 ] Screen Capture – The HVNC component captures the screen using GDI and OpenCV-backed frames (‘GDI BitBlt/GetDIBits + OpenCV-backed frame queue’).
• [T1056.001 ] Input Capture: Keylogging – The malware polls keyboard state to record input (‘GetAsyncKeyState/GetKeyboardState polling imports’).
• [T1539 ] Steal Web Session Cookie – Firefox cookies are explicitly targeted (‘Hardcoded targeting of Firefox cookies.sqlite’).
• [T1217 ] Browser Information Discovery – Firefox browsing data files are targeted to gather browser information (‘Hardcoded targeting of Firefox places.sqlite / permissions.sqlite’).
• [T1219 ] Remote Access Software – The hidden desktop and input simulation function as an unauthorized remote-access channel (‘Hidden-desktop + SendInput architecture’).
• [T1547.001 ] Boot or Logon Autostart Execution: Startup Folder – Persistence is established through a shortcut in the user’s Startup folder (‘AppUpdateHelper.lnk dropped into the current user’s … Startup folder’).