Invoice-named scripts drop a DLL-sideloading backdoor behind Pakistan Navy decoys

An open web directory named documents_more_authority_services holds nine small text files, Invoice1.txt to Invoice9.txt. Each file is a one-line Windows command script. When run, a script shows the victim a convincing PDF, installs a backdoor inside a legitimate Microsoft program, sets that program to restart every minute and hides the install folder.

The decoy PDFs show who the operation is aimed at: Pakistan Navy planning minutes, quotations from a Pakistan Navy supply contractor, a Punjab government directory and a personnel form from a state-owned mining corporation.

The command server was live at the time of writing, on September 25th, 2026.

We found the directory through MalwareHunterTeam, who first flagged it publicly (@malwrhunterteam on X). The analysis of the backdoor, its command server and its protocol is Tuxxin's.

The technical writeup is on whack.sh. It covers the infection chain, the backdoor's protocol and commands, and the full indicator list with hashes. whack.sh now detects this kind of malicious staging area.

The decoys and who they point at

Each script opens a different decoy. The filenames below are what a victim sees in their Temp folder.

This report omits the names of individuals who appear in the decoys.

The AMAN 2027 minutes

The AMAN 2027 minutes are an internal Navy record. They are dated September 9th, 2026, and they reached the attackers within two weeks of being written.

That suggests the operators already have access to someone on the document's distribution, or to a mailbox that received it.

How a victim gets infected

The directory sits on corecloudwave[.]online and is served over WebDAV on port 7843. WebDAV lets Windows treat a remote web directory as a network folder. Each script ends by disconnecting from that share, which confirms that victims run the scripts from it.

We did not recover the email or shortcut that first points a victim at the share. The directory listing shows a file was removed on September 24th.

When run, a script does six things:

1. Downloads the decoy PDF from a second port, 7925, and opens it, so the victim sees a document.
2. Creates the folder C:\Users\Public\Documents\EdgeUpdate\.
3. Downloads dcntel.dll and a small file named edgeupdate.dat.
4. Copies the genuine, Microsoft-signed C:\Windows\System32\DeviceCensus.exe into the same folder.
5. Registers a scheduled task named EdgeUpdate that runs that copy every minute.
6. Marks the folder hidden and system.

The technique is DLL sideloading. When the trusted Microsoft program starts, it loads dcntel.dll from its own folder before it looks in System32, so it loads the attacker's copy.

The malicious DLL passes six of its seven functions straight through to the real Windows DLL, so nothing visibly breaks. The seventh, GetCensusRegistryLocation, holds the backdoor.

What the backdoor does

dcntel.dll is a 291 KB 64-bit Windows DLL, compiled September 16th, 2026, and unsigned. On the day it was found, 6 of 75 antivirus engines on VirusTotal flagged it, all with generic machine-learning labels and no family name.

Its server address is stored separately, in edgeupdate.dat, as plain hexadecimal. It decodes to viewpipesync[.]online on port 9090.

The implant builds a victim ID from the computer name, user name and process ID, finds its own internal IP address, and then polls its server every 10 seconds. It ignores certificate errors. Whatever the server returns is the next command, and the results go back to the same address.

The backdoor is a compact remote shell. Its commands start and stop an interactive cmd.exe session, change how often it polls and replies, change its lifetime counter, report its settings and exit.

File theft, keylogging and any other task outside the command set require the operator to work by hand in the shell.

Infrastructure

We found two domains behind the operation, both registered through Namecheap and both hosted with UltaHost in Germany.

The two domains were registered five minutes apart, and each sits alone on its own server.

We found no related infrastructure. The operation appears to be a single, purpose-built setup.

Attribution

This report leaves attribution open.

Two things fit patterns seen in regional espionage in South Asia: the targeting of the Pakistan Navy, its supply chain and Pakistani government bodies; and the lightweight, disposable infrastructure.

We found no code overlap with a known malware family, and targeting alone is insufficient to identify an actor.

Signs of infection

On a Windows machine:

• The folder C:\Users\Public\Documents\EdgeUpdate\, marked hidden and system.
• A scheduled task named EdgeUpdate that repeats every minute.
• DeviceCensus.exe running from any folder outside C:\Windows\System32.

On the network: HTTPS to port 9090 with a URL path starting with /nsearch:, or any request carrying the header X-Proxy-Server: direct.

Domains and IP addresses:

corecloudwave[.]online
viewpipesync[.]online
84.200.192[.]6
84.200.193[.]224
64.111.93[.]196

The full indicator list, with SHA-256 hashes for dcntel.dll, edgeupdate.dat and all nine scripts, is in the whack.sh technical writeup.

Disclosure

On September 25th, 2026, Tuxxin LLC:

• notified the hosting provider (UltaHost) and the registrar (Namecheap) of both domains,
• shared indicators with Pakistan's national CERT (PKCERT), and
• submitted the stager scripts to VirusTotal.

All malicious domains and IP addresses in this report are defanged.

This report is the original work of Tuxxin LLC, published under Creative Commons Attribution-NoDerivatives 4.0. Media and researchers may quote and republish it with attribution to Daniel Jones, Tuxxin LLC. For coordinated disclosure: contact@tuxxin.com.