WatchGuard Says Brazilian Phishing Crews Are Dressing Malware Up as Windows Error Reporting, Using Fake Notary Notices, Defender Exclusions and Side-Loaded VLC and VMware Files to Deliver Overlord RAT and Lampion

LONDON - On an infected machine, the scheduled task looks like part of Windows. It is called Windows Error Reporting and it runs a file named WerFault.exe, the name of the genuine Windows crash reporter. According to WatchGuard, it lives in the wrong folder and its job is to keep a remote access trojan running.

In research published Oct. 22, WatchGuard Red Cell researcher Euler Neto describes three malware campaigns built on Visual Basic scripts that target Brazil and Portugal. Two deliver remote access tools, Overlord RAT and an unnamed Pascal backdoor, and one delivers the long-running Lampion banking trojan. What ties them together, Neto writes, is how much each step borrows from something trusted: Windows component names, Dropbox and Google Cloud Storage for hosting, and legitimate signed programs that load malicious code.

A notary notice with a real company number

The Overlord RAT campaign starts with email that poses as Brazilian protest notaries, the offices where unpaid debts are formally registered. WatchGuard lists eight lookalike domains, including 1protestorecife[.]com, protestobh[.]com and tabelionatojoinville[.]com. The links embed a valid CNPJ, the national registry number for Brazilian companies. The protest notary office in the state of Goias posted a scam warning about the emails on its own site.

The link downloads an obfuscated VBScript with comments in Brazilian Portuguese that hides its strings with Chr() calls. It fetches the next stage from Dropbox with curl and falls back to PowerShell if curl fails. A batch file asks for administrator rights, sets its install folder to C:\ProgramData\Microsoft\Windows\WER, adds Microsoft Defender exclusions and pulls the payload, in one version from a Google Cloud Storage bucket named win777win.

Two tasks named Windows Error Reporting

When it runs, a file called CLUpdater.exe creates two scheduled tasks, WindowsErrorReporting and WindowsErrorReportingHourly, which start C:\ProgramData\Microsoft\Windows\WER\WerFault.exe. Another script in the chain, 7seven7.bat, carries its payload as a single Base64 line of more than 20 million characters behind a "::" comment marker. Its command line builds .NET and Windows API names on the fly, decodes the payload into memory and starts it as a new thread without writing it to disk.

The main payload is written in Go. It checks for VMware and VirtualBox folders, copies itself to a WER folder under the user's AppData as WerFault.exe, excludes that folder from Defender and adds a Startup folder entry. It then downloads a file named werdata.db, which WatchGuard found is encrypted with the Chaskey cipher in counter mode and decrypts to Donut x64 shellcode. During execution it checks for Overlord RAT configuration files, uses the string OVERLORD-SECURE-LOG and talks to 191[.]96[.]225[.]125 on port 5173.

Other scripts in the same campaign install MSI packages from a bucket named protesto-att instead. Both MSIs WatchGuard examined use DLL side-loading, one through Microsoft's genuine .NET tool ngentask.exe and the other through the VLC media player, both installed under a Temp\Adobe folder in the user's AppData, and they reach Overlord RAT at 45[.]158[.]8[.]213. The scripts reference Brazilian banks and brokers including C6 Bank, PicPay, Banco Pan, Banco Inter, Banco Original, Caixa Economica Federal and Modalmais.

Lampion and a VMware file in an ISO

The second campaign delivers Lampion to targets mostly in Portugal. Phishing emails carry ZIP files named like payment receipts that hold an HTML file linking to a VBScript on AWS S3 or Google Drive. The scripts weigh about 5 MB, but WatchGuard says only about 5 KB of that is code that runs; the rest is junk meant to slow analysts down.

The third campaign uses a Portuguese page titled "Download Seguro - Factura" with a fake captcha that hands out an ISO file. Inside are a VBScript, VMware's genuine vnetlib.exe and a malicious newdev.dll that vnetlib.exe loads. The DLL decrypts a 64-bit Pascal backdoor that persists through an HKCU registry entry pointing to the legitimate executable and calls 148[.]224[.]62[.]243 on port 7777, retrying every three seconds. Its commands include remote mouse and keyboard control, command execution, file writes, screen streaming, a hidden interactive shell and self-removal.

WatchGuard notes a recurring number 7 across the cases, in win777win, agent777.msi, 7seven7.bat, a "user7" marker in the Lampion scripts and the backdoor's port 7777, along with Brazil-based infrastructure. It does not claim a single operator.

What detection teams can hunt for

• WerFault.exe running from C:\ProgramData\Microsoft\Windows\WER or a WER folder under a user's AppData, rather than System32, and scheduled tasks named WindowsErrorReporting or WindowsErrorReportingHourly that launch it.
• wscript.exe or cscript.exe spawning curl, PowerShell or msiexec, especially when curl fails over to PowerShell for the same download from Dropbox or storage.googleapis.com.
• PowerShell Add-MpPreference exclusions for WER paths, and batch files that request elevation before doing so.
• ngentask.exe or vlc.exe running from AppData\Local\Temp\Adobe, and vnetlib.exe running from a mounted ISO or user folder next to a newdev.dll.
• Outbound connections to 191[.]96[.]225[.]125 and 45[.]158[.]8[.]213 on port 5173, and to 148[.]224[.]62[.]243 on port 7777.

WatchGuard's broader advice is to watch behavior rather than files: unexpected script execution, changes to Defender settings, new scheduled tasks and startup entries, and trusted programs loading code from unusual places.