HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

This report analyzes an active LATAM-targeted phishing campaign that uses fake DocuSign and NFe tax-document lures to deliver a custom HVNC backdoor capable of hidden remote desktop control, keystroke monitoring, Firefox cookie/history theft, AV/EDR discovery, and Startup-folder persistence; the analysis includes static and dynamic findings, IOCs (file hashes, IPs, domains, mutex and filenames), MITRE ATT&CK mapping, and operational detection/hunting guidance.