PureHVNC RAT Distributed via Weaponized Judicial Documents

The campaign leverages judicial document themes to distribute Hijackloader malware, which subsequently deploys PureHVNC remote access trojan (RAT)—marking the first observed instance where this combination has been used against Spanish-speaking users in Latin America.

The campaign represents a significant tactical shift for threat actors operating in the region. Hijackloader, previously documented in campaigns targeting CrowdStrike customers with RemcosRAT delivery, has now been repurposed to distribute PureHVNC, a malware-as-a-service tool actively sold on underground forums and Telegram channels.

Between August and October 2025, IBM X-Force identified a sophisticated campaign targeting Colombian users through emails impersonating the country’s Attorney General’s office.

Between August and October 2025, IBM X-Force identified This convergence of established attack infrastructure with emerging payload delivery demonstrates the evolving threat landscape facing LATAM organizations.

Threat actors crafted convincing emails falsely claiming to originate from Colombia’s Attorney General’s office, informing recipients that lawsuits have been filed by former employees and are pending processing before labor courts.

The emails include SVG file attachments designed to be opened in Google Drive, providing victims with a sense of legitimacy while obscuring the malicious nature of the payload.

When victims click on the document preview or attempt to download the file through Google Drive, they receive a ZIP archive containing multiple files, including a password-protected executable.

The password is prominently displayed on the download completion page, encouraging victims to extract and execute the malicious binary.

This social engineering approach exploits trust in judicial processes and official communications—psychological tactics particularly effective in high-context cultures where legal correspondence commands immediate attention and compliance.

Multi-Stage Infection Chain

The infection chain begins with DLL side-loading, a technique that abuses Windows library loading mechanisms. Hijackloader renames a legitimate javaw.exe file with a judiciary-themed name (“02 BOLETA FISCAL.exe”) and places a malicious JLI.dll in the same directory.

When the renamed executable launches, Windows loads the modified DLL from the local directory instead of the system path, establishing the initial foothold for malware execution.

Subsequent stages involve sophisticated loader functionality. The malware decrypts encrypted configurations stored in temporary files, performs anti-analysis checks including virtual machine detection and debugger identification, and implements code injection techniques to load PureHVNC into legitimate system processes.

The malware employs multiple evasion strategies, including stack spoofing to mask API call origins, unhooking of security monitoring hooks installed by antivirus software, and timing-based anti-debugging mechanisms that measure instruction latency to detect analytical environments.

The shellcode is then loaded into vssapi.dll, which is the DLL specified in the malware’s configuration.

Hijackloader’s modular architecture enables customizable behavior through configuration flags. The malware supports multiple persistence mechanisms, including scheduled task creation and startup folder shortcuts, ensuring continued access across system reboots.

Its anti-virtualization routines detect sandbox environments by querying physical memory, processor counts, and hypervisor signatures, automatically terminating if insufficient resources suggest an analysis environment.

The malware incorporates UAC bypass capabilities through both legitimate privilege escalation methods and COM interface exploitation, enabling lateral movement and privilege elevation when running with standard user permissions.

Its injection methods vary based on configuration parameters, supporting process hollowing, thread context hijacking, and NTFS transacted file techniques to execute payloads while evading memory-based detection systems.

Expanding Threat Landscape

X-Force’s analysis demonstrates that threat actors are increasingly combining established delivery mechanisms with emerging payload toolkits to target LATAM regions.

The use of PureHVNC—a commercially available RAT typically associated with cybercriminal services—suggests either a shift toward more accessible malware-as-a-service offerings or collaboration between established Hijackloader operators and criminal entities offering RAT deployment services.

Organizations in Colombia and throughout Latin America should implement advanced email filtering, disable SVG preview functionality in cloud storage services, and deploy behavioral analysis tools capable of detecting DLL side-loading and process injection techniques.

User awareness training emphasizing verification of official communications through direct contact with source organizations remains critical for mitigating social engineering attacks targeting judicial and governmental authorities.

Indicators of compromise

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.