HelloNet campaign: new malicious modules launched through the ViPNet update system

The HelloNet campaign is an active APT attack that began in May 2026, leveraging the ViPNet update system to deploy malicious components on targeted Russian organizations in government, energy, transport, education, and logistics sectors. Attackers achieve persistence via DLL sideloading by placing a malicious wtsapi32.dll in the ViPNet Update System directory, which is loaded by the legitimate itcsrvup64.exe process. The malware includes multiple components: HelloInjector (a loader), HelloProxy (a proxy and payload launcher), and HelloBackdoor (a Rust-based backdoor). The attackers use SSH tunnels via renamed PuTTY binaries and conduct reconnaissance using standard Windows commands. Attribution to a Chinese-speaking APT group is considered low-confidence due to potential false flags.

AI-extracted · verify before operational use