Hijackloader Strikes Colombia with PureHVN

Summary

Between August and October 2025, a phishing campaign in Colombia exploited public trust by impersonating the Attorney General’s office to deliver Hijackloader malware, which in turn deployed PureHVNC, a remote-access tool (RAT) traded on underground forums. The campaign used Google Drive-hosted SVG files disguised as official legal documents to trick recipients into downloading password-protected ZIP archives.

This marks the first known large-scale use of Hijackloader and PureHVNC in Latin America, showcasing a growing trend of regionally targeted, multi-stage attacks combining social engineering and advanced evasion techniques. The operation demonstrates both technical sophistication and a clear focus on stealth, aiming to infiltrate Windows systems for persistent remote control and data theft.

Attack Details

The phishing emails prompted victims to download legal documents allegedly issued by the Attorney General’s office. Upon downloading the password-protected ZIP, the contained executable launched Hijackloader, which initiated a multi-stage infection chain culminating in the deployment of PureHVNC.

1. Delivery Mechanism:
   Victims received SVG links hosted on Google Drive. When the preview failed, they were encouraged to download the file, leading to the password-protected archive.
2. DLL Side-Loading for Stealth:
   Hijackloader disguised itself as a legitimate application by using DLL side-loading. A renamed executable triggered the malicious DLL chain (JLI.dll → MSTH7EN.dll), giving the impression of a legitimate process while executing the payload.
3. Payload Reconstruction and Injection:
   The malware decrypted and decompressed an encrypted artifact (Plagkeg.zk), rebuilt executable shellcode, and injected it into the vssapi.dll process to evade detection.
4. Modular Framework:
   The final ti64 stage supported up to 40 modules—the analyzed sample contained 35—responsible for persistence, privilege escalation, information theft, and system control.
5. Advanced Evasion and Persistence:
   Hijackloader used stack spoofing, indirect API calls, and TinyCallProxy64 patching to hide its behavior. It compared in-memory ntdll.dll with a clean version to remove monitoring hooks. For persistence, it created scheduled tasks, startup shortcuts, and reloaded configurations via modTask and PERSDATA, ensuring long-term survival even after reboot.

Recommendations

1. Be Cautious with Unexpected Emails
   Avoid opening attachments or links claiming to be from government agencies or legal authorities, especially those involving lawsuits or urgent requests.
2. Avoid Password-Protected ZIP Files
   Treat unsolicited password-protected ZIPs as highly suspicious; these are often used to evade email security filters and deliver malware payloads.
3. Use Trusted File-Sharing Platforms Carefully
   Even legitimate platforms like Google Drive can be exploited. Verify file types before downloading and never execute unknown .exe files.
4. Keep Windows and Software Updated
   Apply security patches regularly to mitigate DLL side-loading and privilege escalation risks.
5. Enhance Endpoint Protection
   Deploy Next-Gen Antivirus (NGAV) and EDR solutions that use behavioral analysis and machine learning to detect malicious activities early.

Indicators of Compromise (IoCs)

Email Address:

• troquelesmyj[@]gmail.com

Domains:

• nuevos777[.]duckdns[.]org
• 7octubredc[.]duckdns[.]org
• dckis13[.]duckdns[.]org
• dckis7[.]duckdns[.]org
• enviopago[.]mysynology[.]net
• maximo26[.]duckdns[.]org
• sofiavergara[.]duckdns[.]org

URLs:

• hxxps[:]//drive[.]google[.]com/file/d/1haApB_GMwZb83nw1YPdIDTLMtksRjkh/view?pli=1
• hxxps[:]//drive[.]google[.]com/file/d/1wzunPhL33jq_ZQug6k03hgxi4Eu57VfN/view?usp=sharing

SHA256 Hashes (Samples):

• e7120d45ee357f30cb602c0d93ed8d366f4b11c251c2a3cd4753c5508c3b15e5
• 14becb3a9663128543e1868d09611bd30a2b64c655dfb407a727a7f2d0fb8b7e
• 776bbaa44c7788e0ccd5945d583de9473b6246c44906692cb0a52e6329cb213a
• 1ae61edf35127264d329b7c0e2bddb7077e34cc5f9417de86ab6d2d65bad4b4f
• 85641c8fb94e8e4c5202152dcbb2bb26646529290d984988ecb72e18d63c9bc5
• (Additional hashes listed in full advisory)

MITRE ATT&CK TTPs

Tactics:

• TA0001: Initial Access
• TA0002: Execution
• TA0003: Persistence
• TA0004: Privilege Escalation
• TA0005: Defense Evasion
• TA0011: Command and Control

Techniques:

• T1566 / T1566.001 / T1566.002: Phishing (Attachment, Link)
• T1574 / T1574.001: Hijack Execution Flow (DLL)
• T1055 / T1055.012: Process Injection / Process Hollowing
• T1106: Native API
• T1027 / T1140: Obfuscated or Deobfuscated Files
• T1548 / T1548.002: Privilege Escalation (UAC Bypass)
• T1053 / T1053.005: Scheduled Task / Job
• T1497 / T1497.001: Virtualization / Sandbox Evasion
• T1036: Masquerading
• T1071 / T1071.001: Application Layer Protocol / Web Protocols
• T1204 / T1204.002: User Execution (Malicious File)

• T1059: Command and Scripting Interpreter

References

• IBM X-Force Threat Analysis: “LATAM Baited into Delivery of PureHVNC”

• MITRE ATT&CK Framework

Report Generated: October 30, 2025 | Admiralty Code: A1
© 2025 Hive Pro | All Rights Reserved
Learn more: www.hivepro.com