--[ Anomalía #20 - From PDF to RAR: the layers of a file ]--
October 30, 2026
By: ZoqueLabsThis writing is distributed under a Creative Commons CC BY-SA (Acknowledgment - Share Alike) license.
Spanish version
Hello hello!
Today we have something special to share: we published our Experiment 0x04, a threat intelligence exercise that we call The Mysterious PDF.
It all started with a suspicious file we received from another civil society organization during an investigation. At first glance it looked like a PDF related to a hotel warranty, but there was something strange about it: its extension was .rev. When we started reviewing it we found a PDF header and, hidden within the same file, a RAR containing a malicious script for Windows.
And well we decided to follow the clues.
What seemed like a fairly simple file ended up becoming a much larger investigation. We reconstructed an infection chain that included Visual Basic scripts, PowerShell, obfuscated code, malware persistence and execution mechanisms within legitimate Windows processes. At the end of that tour we find Remcos, a commercial remote access tool that can also be used to monitor and control devices.
But the investigation did not end there.
Following the artifacts and infrastructure we find connections with Operation Golden Boa, documented by SCILabs, which mainly affected hotels and companies in the tourism sector in Latin America. We also found other files, domains and components which led us to wonder if we were looking at a single operation, multiple actors or even some kind of malware distribution service. We don’t have all the answers, but we do share the clues we found and how we got to them.
In Experiment 0x04 — The Mysterious PDF we publish that journey: from inspecting the original file to deobfuscating scripts, analyzing loaders, rebuilding the infection chain and searching for infrastructure. It’s a pretty technical CTI exercise, but we try to explain each step so other people can follow it, reproduce it, and learn from it. And there is another part that especially interests us.
Although everything points to a financially motivated cybercrime campaign, the malware we found has capabilities that can also be used to monitor people. Remcos is a commercial product, available for a fraction of the cost of the mercenary spyware tools we often talk about. However, it can allow deeply intrusive access to its victims’ devices and has appeared in spy operations.
That is why we dedicated part of the experiment to discussing the victimology and responsibilities of those who develop and market these types of tools. Who is being attacked? What changes when a trading tool ends up used for surveillance? What responsibility does the industry have for the uses of its products?
If you do not have technical knowledge, you are also invited to read the experiment. Especially the «victimology» and «Cheap Spyware, Expensive Liability» chapters, where we address these questions without needing to understand PowerShell, reverse engineering, or exploitation chains. We believe that this discussion is also of interest to those who work on human rights, incident monitoring, investigation and public policies.
And for those who enjoy taking apart suspicious files, there’s plenty of code, commands, artifacts, and clues to explore.
We started with a file that looked like a PDF and ended up much further away than we expected. Now we invite you to continue that journey with us.
And that being no more, Anomalía.
--[Surveillance ]--
Mexico - Cartels also know how to cross-reference data
A CSIS analysis examines how criminal organizations are leveraging surveillance cameras, phone records, geolocation and business data to identify and pursue people. The text recovers a case in Mexico in which a cartel had hired a hacker to track an FBI official and cross-reference his movements with city cameras, thus identifying sources and collaborators who were subsequently intimidated or murdered. A rather disturbing example of how the surveillance capabilities that we usually associate with States are also within the reach of organized crime.
Brazil - Smart Sampa and the consequences of exposing surveillance cameras
The exhibition of access to the Smart Sampa video surveillance system, in São Paulo, opened a discussion about the responsibility of the authorities and possible compensation for the affected people. The case is especially interesting because the discussion is moving from technical failures to their legal consequences. Brazil’s National Human Rights Council also called for suspending the system and promoting investigations into security deficiencies. A perspective worth following when we talk about personal information leaks.
Opposing cameras can also make you suspicious
Documents obtained by 404 Media show that a California intelligence center warned police about possible suspicious behavior during city council meetings discussing the installation of Flock cameras. The bulletin acknowledged that there were no specific, credible threats, but still cited the presence of protesters, verbal confrontations and media coverage as possible risks. It is worrying that citizen participation against surveillance ends up being treated as a matter of police intelligence.
Serbia - New cases of Pegasus
Citizen Lab and SHARE Foundation documented new spyware operations against figures linked to protests and anti-corruption investigations in Serbia. The analysis confirmed an infection with Pegasus on the device of Vladan Đokić, rector of the University of Belgrade and a supporter of the student movement. It also identified a threat notification received by prosecutor Rade Bajić, although in this second case an infection has not yet been confirmed. The findings add to a series of investigations into surveillance against students, activists and opposition figures in the country. SHARE Foundation
--[Malware and Technical Analysis ]--
SiriusQT: A RAT with HVNC and a surredatory market
Group-IB analyzes SiriusQT, a RAT marketed in clandestine forums since April 2026 that combines remote control using HVNC, credential theft, keylogging, browser automation and process inysection. The research examines both technical and su distribution, licensing and command and control infrastructure. Los researchers identified more than 280 muestras del client and 146 unique liquecences. It is interesting to follow this type of arramient if they disarroll and market, and how many operators are distributed geographically. Group-IB
More than 300 Tor exit nodes compromised
Research published by KABA documents an operation in which attackers compromised 333 Tor exit nodes, approximately 10% of those existing at the time. The servers had been infected with Ebury, a backdoor for Linux capable of stealing SSH credentials. The attackers used the nodes to intercept SSH connections and collect unencrypted mail traffic. After receiving the report, the Tor team marked the nodes as BadExit and coordinated their isolation. A particularly relevant case for those of us who depend on anonymity infrastructure. KABA
Millions of abandoned Popcorn Time installations and an unexpected update
Eye Security encontró que una versión antigua de Popcorn Time seguía consultando dominios de actualización que ya habían expirado. Al registrar uno de ellos, los investigadores descubrieron millones de clientes potencialmente vulnerables a la ejecución remota de código con privilegios elevados. Ante la ausencia de un desarrollador que pudiera corregir el problema, decidieron distribuir actualizaciones para desactivar el mecanismo vulnerable en Windows y macOS, sin intervención de las personas propietarias de los equipos. Reportan más de dos millones de descargas de la actualización. Una investigación técnicamente fascinante que también plantea preguntas sobre consentimiento, límites y responsabilidad en la investigación de seguridad.
uCreator: Android Spying as a Service
Research on uCreator describes a commercial platform that allows you to distribute modified Android applications to steal credentials, intercept messages, and compromise Telegram and WeChat accounts. The analysis of an exposed GitLab server allowed us to know part of the code and the organization behind the tool. There are also connections to previous fake app campaigns, some promoted through ads in Portuguese and targeting people in Brazil. Another example of how mobile malware can be marketed as a reusable service.
--[ AI and offensive operations ]--
LATAM - Vapor Panda uses AI agents against Latin American ministries
CrowdStrike documented a campaign attributed to China-linked actor Vapor Panda, which used the ARTEX framework and language models to coordinate intrusions against more than 200 organizations in different regions. Among its objectives were foreign ministries of Latin American countries, with exploitation and deployment activity of the BLOODALCHEMY backdoor. Agents automated reconnaissance, exploitation and movements within networks, while human operators intervened to guide actions. The report does not publicly identify all affected countries, but confirms that Latin America was among the target regions. CrowdStrike
Argentina - AI agents compromise health organizations
Another CrowdStrike investigation, reviewed by CRN Asia, describes four actors incorporating programming assistants and AI agents into offensive operations. One of the most interesting cases occurred in Argentina, where an operator compromised at least fifteen health sector organizations through a framework coordinated by Claude Code agents. In one of the intrusions, the agent changed strategy after finding a Pass-the-Hash attack blocked and managed to establish a reverse shell on a domain controller. Operations against government entities in Brazil and Colombia were also documented.
LATAM - CARLIY0S: several coordinated AI models to attack Latin American banks
Straiker published an investigation into CARLIY0S, a system used by CyberCartel to organize operations against banks and payment providers in Latin America. Based on information obtained from the group’s own environment, the researchers describe an architecture where different models fulfill functions of analysis, execution and evaluation of objectives, sharing information through a knowledge graph. The research identifies a list of more than 400 financial institutions as targets, although that does not mean that all have been compromised. It is an interesting case to understand how AI begins to join the cybercrime organization, beyond generating phishing scripts or emails.
Cairn: AI agents attacking websites and leaving their own panels exposed
NorForge found, through searches of Censys and Shodan, more than 20 Cairn panels apparently used in malicious operations. Cairn is a system that coordinates AI agents to investigate targets, search for vulnerabilities, and attempt to exploit them. One of the identified groups accumulated more than 1,100 attack projects, mainly against e-commerce sites. The researchers even confirmed actual commitments and estimated a success rate close to 10% among the observed operations. The curious thing is that the attackers themselves left their panels unprotected, exposing credentials, information about their victims and controls to direct the agents.A quite interesting window into how these tools are being used in real operations and the operational safety problems of those who use them.
--[Platforms and misinformation ]--
The protests in France and the influence operations
Alliance4Europe analyzed more than half a million posts related to the October 2026 protests in France. The investigation found no evidence that foreign actors had originated the demonstrations, but it did identify networks that took advantage of discontent to amplify polarizing narratives. Among them is Doppelganger, an operation attributed to Russia, which spread coordinated messages about Ukraine and European policies. The report also examines how these narratives circulated internationally and reached AI systems.
Covert influence operations on TikTok
TikTok’s transparency portal documents covert influence networks that the platform identifies and removes. Among the reported cases are operations related to Colombia, Brazil, Peru and Haiti, which makes it interesting to review how these campaigns try to influence public conversations in the region. As with other transparency reports published by platforms, the data allows us to know part of the operations detected, but also depends on the criteria and visibility that the company itself decides to offer.
Goal and restrictions on political accounts in Brazil and the United States
In Brazil, internal messages published by the press showed that Meta staff recognized restrictions that affected the visibility and promotion of Lula’s campaign publications. The company attributed the problems to technical errors. In the United States, the No Kings coalition denounced that Instagram temporarily suspended its account during a day of mobilizations and that, even after restoring it, its administrators had difficulties publishing. Although these episodes do not in themselves demonstrate deliberate political intervention, they show how much the decisions and failures of the platforms can affect the organization and communication of social movements and political campaigns.
--[ Infrastructure and conflicts ]--
Brazil - A Brazilian city without Internet due to attacks on fiber optics
Groaíras, in the state of Ceará, spent more than two days with Internet interruptions after fiber optic cables from several providers were cut. The attack also affected neighboring Cariré. According to the Brazilian federation FENINFRA, criminal groups have threatened legal providers to impose clandestine connectivity services. The authorities are investigating the facts, although they have not yet publicly confirmed all the powers. A case where the territorial control of organized crime extends directly to the telecommunications infrastructure. Digital Convergence
The Pentagon is preparing an office specialized in technological sabotage
According to an investigation by Politico, the US Department of Defense created the Technology Support Office, a structure intended to develop capabilities to disrupt or sabotage foreign technologies considered threats to its military superiority. The initiative reorganizes existing intelligence programs and seeks to leverage tools developed by private contractors, from cyber capabilities to other forms of technological interference. Although the office’s operational scope remains classified and the Pentagon has questioned parts of the report, the initiative raises questions about private industry involvement and oversight mechanisms for these operations.
--[ Exfiltradaz - Snapshot from 10/16/2026 to 10/30/2026 ]--
During this period, 8 references to leaks, compromised accesses and publications associated with ransomware were identified in three Latin American countries. Brazil as always concentrated the largest number of records, with four references, followed by Mexico, with three, and Bolivia, with one.
Activity associated with ransomware included publications on organizations in Bolivia and Mexico. Among them are Mercantile Investment Corporation Bolivia SA, the University of New Mexico and Airbus SLC Mexico. The ads attribute the attacks to The Gentlemen, BYOD, and Qilin groups, respectively. These logs correspond to monitoring posts and alerts, not an independent verification of the scope of incidents.
In the credentials market, new posts were observed about access to Brazilian email accounts and TikTok accounts offered together with session cookies. A log record associated with Brazil was also identified in the health category. Among the new authors observed during the period is mrpems88. The main sources were niflheim, mipped, ransomware and cracked.
More details of these leaks in Exfiltradaz.
--[ ZOLIM --> Snapshot 10/16/2026 ]--
8 new and very interesting IPs for this ZOLIM snapshot. With these we have already completed 307 detected servers since we started the observatory. :)
Some interesting signs:
- Mexico: We continue detecting Sliver, this time in Monterrey. This pattern is interesting. On the other hand, we find two instances of CHAOS on the same Mexico City server.
- Panama: Two interesting appearances, a Sliver and a Cobalt Strike for the same days. We have not detected this type of implants in Panama since January of this year.
> If you want to go deeper, take a look at ZOLIM. In the table at the bottom you can search and cross-reference data by country, ASN, IP, threat, city and other fields. Each IP is a good excuse to start researching. :)