HelloNet APT & Daxin Rootkit Resurgence: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential HelloNet DLL Sideloading via ViPNet
id: 3c8f4c12-7b89-4a5d-9f6e-123456789abc
description: Detects potential HelloNet activity involving the sideloading of wtsapi32.dll within ViPNet directories.
status: experimental
author: Security Arsenal
date: 2026/07/17
references:
    - https://securelist.com/tr/hellonet-vipnet/120700/
tags:
    - attack.defense_evasion
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\wtsapi32.dll'
        Image|contains: 'ViPNet'
    condition: selection
falsepositives:
    - Legitimate ViPNet updates (rare)
level: high
---
title: Daxin Rootkit Persistence via Winlogon DLL Load
id: 5d9g5e23-8c90-5b6e-0g7f-234567890bcd
description: Detects suspicious DLLs loaded by winlogon.exe, typical of Daxin/Stupig keyboard layout persistence or similar rootkits.
status: experimental
author: Security Arsenal
date: 2026/07/17
references:
    - https://www.security.com/blog-post/daxin-returns-stupig
tags:
    - attack.persistence
    - attack.t1014
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\winlogon.exe'
        ImageLoaded|contains: '\System32\'
        ImageLoaded|endswith: '.dll'
        Signed: false
    filter:
        ImageLoaded|contains:
            - '\System32\kbdr'
            - '\System32\KBD'
    condition: selection and not filter
falsepositives:
    - Uncommon but legitimate keyboard layout updates
level: critical
---
title: NetSupport RMM Python Side-Loading
id: 6e0h6f34-9d01-6c7f-1h8g-345678901cde
description: Detects the execution of Setu.exe loading a suspicious python37.dll, indicative of the NetSupport RMM campaign.
status: experimental
author: Security Arsenal
date: 2026/07/17
references:
    - https://x.com/Kostastsale/status/2066545189137629302
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\Setu.exe'
        ImageLoaded|endswith: '\python37.dll'
    condition: selection
falsepositives:
    - Legitimate Python application installers
level: high


kql
// Hunt for HelloNet related processes and NetSupport C2 connections
DeviceNetworkEvents
| where RemotePort == 7000 or RemoteIP == "138.124.186.2" 
   or RemoteUrl in ("bsc.blockrazor.xyz", "xn--fiqq24b9hejs1c.clickvector.tech")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| union (
    DeviceProcessEvents
    | where ProcessVersionInfoCompanyName contains "Infotecs" // ViPNet Vendor
       or ProcessCommandLine contains "wtsapi32.dll"
       or FileName == "Setu.exe"
)
| order by Timestamp desc


powershell
# IOC Hunt Script for HelloNet and Daxin Persistence
Write-Host "Starting Hunt for HelloNet and Daxin Artifacts..." -ForegroundColor Cyan

# 1. Check for HelloNet wtsapi32.dll in ViPNet directories
$vipnetPaths = @("${env:ProgramFiles}\Infotecs", "${env:ProgramFiles(x86)}\Infotecs", "${env:LocalAppData}\Infotecs")
$maliciousDll = "wtsapi32.dll"

foreach ($path in $vipnetPaths) {
    if (Test-Path $path) {
        Write-Host "Checking ViPNet Path: $path" -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -Filter $maliciousDll -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host "ALERT: Found $maliciousDll at $($_.FullName)" -ForegroundColor Red
        }
    }
}

# 2. Check for Suspicious Keyboard Layouts (Daxin Indicator)
$klmPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Keyboard Layouts"
if (Test-Path $klmPath) {
    Write-Host "Checking Keyboard Layouts..." -ForegroundColor Yellow
    Get-ChildItem $klmPath | ForEach-Object {
        $layoutFile = (Get-ItemProperty "$($_.PSPath)\")."Layout File"
        if ($layoutFile -and $layoutFile -notmatch "^kbd.*\.dll$") {
            Write-Host "SUSPICIOUS: Non-standard keyboard layout file detected: $layoutFile in Key $($_.PSChildName)" -ForegroundColor Red
        }
    }
}

# 3. Check for NetSupport Scheduled Tasks
Write-Host "Checking Scheduled Tasks for NetSupport/RMM persistence..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*python*" -or $_.Actions.Execute -like "*netsupport*" -or $_.TaskName -like "*python*" } | ForEach-Object {
    Write-Host "SUSPICIOUS Task Found: $($_.TaskName)" -ForegroundColor Red
    Write-Host "Command: $($_.Actions.Execute)" -ForegroundColor DarkGray
}

Write-Host "Hunt Complete." -ForegroundColor Green