GoSerpent RAT + HelloNet ViPNet Supply-Chain Campaign: OTX Pulse Analysis — State-Sponsored Intrusion Detection Pack

---
title: DLL Sideloading via Malicious wtsapi32.dll in ViPNet Directory (HelloNet)
id: 7c3a1f22-9b4e-4d1a-8f5c-hellonet0001
status: experimental
description: Detects creation or loading of wtsapi32.dll inside ViPNet installation directories, a persistence technique used by the HelloNet APT campaign targeting Russian government and critical infrastructure organizations.
author: Security Arsenal Threat Intelligence
date: 2026/08/15
references:
    - https://securelist.com/tr/hellonet-vipnet/120700/
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith: '\wtsapi32.dll'
    selection_path:
        ImageLoaded|contains:
            - '\ViPNet\'
            - '\Infotecs\'
    filter_system:
        ImageLoaded|startswith: 'C:\Windows\System32\'
    condition: selection_dll and selection_path and not filter_system
falsepositives:
    - Legitimate ViPNet updates (validate digital signature on the DLL)
level: high
tags:
    - attack.persistence
    - attack.t1574.002
---
title: GoSerpent Credential Dumping Tool Execution (Mimikatz / QuarksDumpLocalHash)
id: 8d4b2e33-1c5f-5e2b-9a6d-goserpent002
status: experimental
description: Detects execution of credential dumping tooling associated with the TetrisPhantom GoSerpent campaign targeting Southeast Asian government and diplomatic entities, including QuarksDumpLocalHash and Mimikatz variants.
author: Security Arsenal Threat Intelligence
date: 2026/08/15
references:
    - https://securelist.com/goserpent-backdoor-in-southeast-asia/120687/
logsource:
    category: process_creation
    product: windows
detection:
    selection_names:
        Image|endswith:
            - '\QuarksDumpLocalHash.exe'
            - '\mimikatz.exe'
            - '\Stowaway.exe'
            - '\TmcLoader.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'QuarksDumpLocalHash'
            - 'sekurlsa::'
            - 'lsadump::'
    selection_service:
        Image|endswith: '\ThumbcacheService.exe'
    condition: 1 of selection_*
falsepositives:
    - Authorized penetration testing activity
level: critical
tags:
    - attack.credential_access
    - attack.t1003
    - attack.execution
---
title: Suspicious Go/Rust Binary Network Beaconing with Encrypted Arguments
description: Detects processes launched with unusually long or high-entropy argument strings followed by outbound network activity, consistent with GoSerpent's encrypted-argument execution model and staged Go/Rust implants.
author: Security Arsenal Threat Intelligence
date: 2026/08/15
status: experimental
id: 9e5c3f44-2d6a-6f3c-ab7e-encargs003
logsource:
    category: process_creation
    product: windows
detection:
    selection_long_args:
        CommandLine|re: '^.{200,}$'
    selection_nonstandard_path:
        Image|contains:
            - '\Temp\'
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
    filter_known:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\Teams.exe'
    condition: selection_long_args and selection_nonstandard_path and not filter_known
falsepositives:
    - Legitimate software installers with encoded parameters
level: medium
tags:
    - attack.execution
    - attack.t1027

// Hunt: HelloNet DLL sideloading + GoSerpent tooling execution + known-bad hashes
// Microsoft Sentinel / Defender XDR — run over last 30 days minimum
let BadHashes = dynamic([
  "ebffd5a76aaa690bcdb922f82e0bacc5","dc506ff7bb72735444fb3703a6bee6d8",
  "d6e86bf8a90e9b632add5fa495f97fbc","cb6c4c70a3b171fa3404b8e1a3382116",
  "64e9d1950e42bc98486dfd9919463d1c","cbbb6d483737ea3566726e51752dff40",
  "7f223ee0716ce2ad56f55d3744419449","19f8befcb035f52bf70094e6b4f5779a",
  "0cfdffc56f0fa325d0c4d24780b46597","16c211c96735f2fae9361b89bd7a31bf",
  "1bfe2b9493128574907a8279256a8bcc","41c938b3cd7e55d4077e34976929b140",
  "6001829a128fe264b4403138700c11a8","9f5606a0755bc633b9bd7db6d179c09e",
  "b103cd21280b4061f88b2bcc51394894","ee4ff46ddd8489e81447962f927bc3f6"]);
let HashHits = union isfuzzy=true
    (DeviceFileEvents
     | where MD5 in (BadHashes)
     | project HitType="HashMatch-FileEvent", TimeGenerated, DeviceName, FileName, FolderPath, MD5),
    (DeviceProcessEvents
     | where MD5 in (BadHashes)
     | project HitType="HashMatch-ProcessExec", TimeGenerated, DeviceName, FileName, FolderPath, MD5, ProcessCommandLine);
let SideloadHits = DeviceImageLoadEvents
    | where FileName =~ "wtsapi32.dll"
    | where FolderPath has_any ("ViPNet", "Infotecs")
    | where not(FolderPath startswith "C:\\Windows\\System32")
    | project HitType="ViPNet-DLL-Sideload", TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine;
let CredToolHits = DeviceProcessEvents
    | where FileName has_any ("QuarksDumpLocalHash", "mimikatz", "Stowaway", "TmcLoader", "ThumbcacheService")
       or ProcessCommandLine has_any ("sekurlsa::", "lsadump::", "QuarksDumpLocalHash")
    | project HitType="GoSerpent-CredTooling", TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName;
union isfuzzy=true HashHits, SideloadHits, CredToolHits
| order by TimeGenerated desc

# GoSerpent / HelloNet host IOC hunt — run elevated on suspected endpoints
# Checks: ViPNet DLL sideload persistence, credential tooling artifacts, suspicious services

Write-Output "=== [1] ViPNet wtsapi32.dll sideload check (HelloNet) ==="
$vipnetPaths = @("$env:ProgramFiles\Infotecs", "${env:ProgramFiles(x86)}\Infotecs", "$env:ProgramFiles\ViPNet", "${env:ProgramFiles(x86)}\ViPNet")
foreach ($p in $vipnetPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Filter "wtsapi32.dll" -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            Write-Output "FOUND: $($_.FullName) | Signature: $($sig.Status) | Signer: $($sig.SignerCertificate.Subject)"
            Write-Output "  MD5: $((Get-FileHash $_.FullName -Algorithm MD5).Hash)"
            if ($sig.Status -ne 'Valid') { Write-Output "  !!! UNSIGNED/INVALID — likely sideloaded payload !!!" }
        }
    }
}

Write-Output "`n=== [2] GoSerpent tooling artifacts ==="
$toolNames = @("QuarksDumpLocalHash*","TmcLoader*","TmcPayload*","Stowaway*","ThumbcacheService*","McMx*")
$searchDirs = @("$env:TEMP", "$env:ProgramData", "C:\Users\Public", "$env:APPDATA", "$env:LOCALAPPDATA")
foreach ($d in $searchDirs) {
    foreach ($t in $toolNames) {
        Get-ChildItem -Path $d -Recurse -Filter $t -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Output "SUSPICIOUS: $($_.FullName) | MD5: $((Get-FileHash $_.FullName -Algorithm MD5).Hash)"
        }
    }
}

Write-Output "`n=== [3] Masquerading persistence services (ThumbcacheService etc.) ==="
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match "Thumbcache|wtsapi|TmcLoader|Stowaway" } |
    Select-Object Name, DisplayName, State, PathName, StartName | Format-List

Write-Output "`n=== [4] Known-bad hash sweep (recent downloads/temp) ==="
$badMD5 = @("ebffd5a76aaa690bcdb922f82e0bacc5","dc506ff7bb72735444fb3703a6bee6d8","d6e86bf8a90e9b632add5fa495f97fbc",
"cb6c4c70a3b171fa3404b8e1a3382116","64e9d1950e42bc98486dfd9919463d1c","cbbb6d483737ea3566726e51752dff40",
"7f223ee0716ce2ad56f55d3744419449","19f8befcb035f52bf70094e6b4f5779a","0cfdffc56f0fa325d0c4d24780b46597",
"16c211c96735f2fae9361b89bd7a31bf","1bfe2b9493128574907a8279256a8bcc","41c938b3cd7e55d4077e34976929b140",
"6001829a128fe264b4403138700c11a8","9f5606a0755bc633b9bd7db6d179c09e","b103cd21280b4061f88b2bcc51394894","ee4ff46ddd8489e81447962f927bc3f6")
foreach ($d in $searchDirs) {
    Get-ChildItem -Path $d -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Length -lt 50MB } | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($h -and ($badMD5 -contains $h.ToLower())) { Write-Output "!!! IOC MATCH: $($_.FullName) [$h] !!!" }
    }
}

Write-Output "`n=== [5] Outbound proxy/tunnel connections (Stowaway/HelloProxy behavior) ==="
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in @(1080,8080,8443,4443) -and $_.OwningProcess -ne 4 } |
    ForEach-Object { $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Output "$($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)" }