Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
Malware Families
Excerpt
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X . Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots. The attack chain combines trusted business lures,…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 25db85830d86cafbb93a660242f8b4017273cc4612e94dd7a8af29c948651bbe | Medium | Score 53/100 | First seen |
| SHA256 | 54716f0738af891f283d213b5c8d11b25896bb8ee3097d301eae718560cf974e | Medium | Score 53/100 | First seen |
| SHA256 | e4d637f884f5babea6525266e1cb6ab332a16a446d6084dd51b4222540c1f16c | Medium | Score 53/100 | First seen |
| SHA256 | 97f35ba586fc121590c867b4d6707777fbeca2ace5ad077807ec806540bb47cd | Medium | Score 53/100 | First seen |
| SHA256 | d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7 | Medium | Score 53/100 | First seen |
| SHA256 | 5fbfc7929858c3c3d79637db857525695db3c0f41b9bf2a7b964c26b7226bde3 | Medium | Score 53/100 | First seen |
| SHA256 | 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca | Medium | Score 53/100 | First seen |
| SHA256 | 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f | Medium | Score 53/100 | First seen |
| SHA256 | debf48e690abd4288e5f76fa7e9f98a9fb3411171eba82906ef0d2bf1ef2dd6d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…