AlienVault OTX pulse data confirms an active, previously undocumented APT campaign — tracked as HelloNet — that has been exploiting the ViPNet update system since at least May 2026 to deliver a modular, multi-stage intrusion toolkit against large organizations inside the Russian Federation. The campaign was publicly documented by Kaspersky's Securelist team and represents a textbook trusted-channel supply chain compromise: rather than attacking perimeter defenses, the operators poisoned or abused a legitimate software update mechanism that target networks are explicitly configured to trust.
The target list is strategic, not opportunistic: government, energy, transportation, education, and aerospace entities. This sector selection, combined with the operational discipline of the tooling (dedicated cleanup components, proxy-based C2, DLL sideloading into a security product's own directories), is consistent with state-sponsored espionage tradecraft. Community tagging on the pulse attributes the activity to a Chinese-nexus APT, though formal attribution remains unconfirmed.
The attack chain is elegant and dangerous:
- Initial access / delivery — malicious payloads are pushed through the ViPNet update system, bypassing perimeter controls because ViPNet (a VPN/network encryption suite widely deployed in Russian enterprises and government) is whitelisted by design.
- Persistence — a malicious
wtsapi32.dllis planted inside legitimate ViPNet installation directories, achieving DLL sideloading (MITRE T1574.002) every time the trusted ViPNet executable launches. - Execution & staging — the HelloInjector loader injects subsequent stages into legitimate processes.
- C2 & exfiltration — HelloProxy proxies operator traffic and delivers additional payloads, obscuring the true C2 destination behind victim-network infrastructure.
- Objective execution — HelloExecutor backdoor provides remote command execution; HelloBackdoor (a Rust-based implant) provides the persistent access layer.
- Anti-forensics — HelloCleaner removes operational artifacts, complicating incident response and attribution.
The strategic objective is almost certainly long-dwell cyber espionage against critical infrastructure and government networks — the tooling is built for stealth and persistence, not monetization or disruption.
Threat Actor / Malware Profile
Attribution: Unknown actor; OTX community tags indicate a Chinese APT nexus. The sophistication of the supply chain vector and the custom Rust tooling indicates a mature, well-resourced state-level operator.
Malware Component Breakdown
| Component | Role | Key Behaviors |
|---|---|---|
| HelloInjector | Loader | Injects payloads into legitimate processes to evade process-based detection |
| HelloProxy | C2 relay / payload delivery | Proxies attacker traffic through victim infrastructure; fetches follow-on stages |
| HelloExecutor | Backdoor | Remote command execution capability |
| HelloBackdoor | Primary implant | Written in Rust; persistent access layer with modern cross-platform design |
| HelloCleaner | Anti-forensics | Deletes logs, staging artifacts, and operational traces post-exfiltration |
Tradecraft Highlights
- Distribution method: Abuse of the ViPNet update system — a trusted supply chain channel. Any organization running ViPNet should treat the update mechanism itself as a compromised trust boundary until vendor attestation is confirmed.
- Persistence mechanism: DLL sideloading via a rogue
wtsapi32.dllplaced in ViPNet directories. Because the legitimate signed ViPNet binary loads the DLL, application whitelisting and signature-based controls are blind to it. - C2 communication: Proxied through HelloProxy, meaning observed C2 traffic may originate from internal victim hosts rather than direct egress — flattening the network visibility that perimeter IDS relies on.
- Anti-analysis: The Rust-based HelloBackdoor defeats many signature sets tuned for C/C++ implants, and HelloCleaner actively destroys forensic evidence. Expect missing or tampered logs during IR.
- MITRE ATT&CK mapping: T1195 (Supply Chain Compromise), T1574.002 (DLL Side-Loading), T1055 (Process Injection), T1090 (Proxy), T1070 (Indicator Removal), T1059 (Command Execution).
IOC Analysis
The pulse contains 11 indicators, all FileHash-MD5 values representing the campaign's component binaries (loader, proxy, executor, backdoor, cleaner stages, and the sideloaded wtsapi32.dll). There are no network IOCs (IPs/domains/URLs) in this pulse — a deliberate consequence of the campaign's proxy-based C2 architecture, which makes static network indicators short-lived and low-value.
Sample indicators (MD5):
0cfdffc56f0fa325d0c4d24780b4659716c211c96735f2fae9361b89bd7a31bf1bfe2b9493128574907a8279256a8bcc41c938b3cd7e55d4077e34976929b1406001829a128fe264b4403138700c11a89f5606a0755bc633b9bd7db6d179c09eb103cd21280b4061f88b2bcc51394894ee4ff46ddd8489e81447962f927bc3f6
Operationalizing These IOCs
- EDR/AV blocklists: Push all MD5s to endpoint prevention platforms immediately. Where possible, derive SHA-256 equivalents via sandbox detonation or OTX indicator pivoting, as MD5-only blocking is fragile.
- Retro-hunt: Sweep all endpoints that have (or had) ViPNet installed. Prioritize the ViPNet installation directories for any
wtsapi32.dllwhose hash does not match the vendor-signed original. - Behavioral pivoting: Because file hashes rotate fast in modular APT tooling, the DLL sideloading behavior (unsigned
wtsapi32.dllloaded by ViPNet processes) is a far more durable detection than the hashes themselves. - Tooling: Use the OTX DirectConnect API / OTXv2 Python SDK to pull the full pulse and feed indicators into your TIP (MISP, OpenCTI, ThreatQ). Cross-reference with Securelist's technical report for YARA rules published alongside the disclosure.
Detection Engineering
YAML
---
title: HelloNet DLL Sideloading via Rogue wtsapi32.dll in ViPNet Directory
id: 8f3a1c2e-7b4d-4e9a-a1f5-hellonet0001
status: experimental
description: Detects DLL sideloading persistence used by the HelloNet APT campaign, where a malicious wtsapi32.dll is placed in ViPNet installation directories and loaded by legitimate ViPNet binaries.
author: Security Arsenal Threat Intelligence
date: 2026/08/16
references:
- https://securelist.com/tr/hellonet-vipnet/120700/
logsource:
category: image_load
product: windows
detection:
selection_dll:
ImageLoaded|endswith: '\wtsapi32.dll'
selection_path:
ImageLoaded|contains:
- '\ViPNet\'
- '\Infotecs\'
filter_signed:
Signed: 'true'
SignatureStatus: 'valid'
condition: selection_dll and selection_path and not filter_signed
falsepositives:
- Legitimate ViPNet updates deploying a signed wtsapi32.dll (verify signature and hash against vendor baseline)
level: high
tags:
- attack.persistence
- attack.t1574.002
- attack.t1195
---
title: HelloNet Component File Hash Detection
id: 8f3a1c2e-7b4d-4e9a-a1f5-hellonet0002
status: experimental
description: Detects known MD5 hashes associated with HelloNet campaign components (HelloInjector, HelloProxy, HelloExecutor, HelloBackdoor, HelloCleaner).
author: Security Arsenal Threat Intelligence
date: 2026/08/16
references:
- https://securelist.com/tr/hellonet-vipnet/120700/
logsource:
category: file_event
product: windows
detection:
selection_hashes:
Hashes|contains:
- '0cfdffc56f0fa325d0c4d24780b46597'
- '16c211c96735f2fae9361b89bd7a31bf'
- '1bfe2b9493128574907a8279256a8bcc'
- '41c938b3cd7e55d4077e34976929b140'
- '6001829a128fe264b4403138700c11a8'
- '9f5606a0755bc633b9bd7db6d179c09e'
- 'b103cd21280b4061f88b2bcc51394894'
- 'ee4ff46ddd8489e81447962f927bc3f6'
condition: selection_hashes
falsepositives:
- None expected; these are confirmed malicious campaign artifacts
level: critical
tags:
- attack.t1195
- attack.execution
---
title: HelloNet Process Injection and Proxy C2 Behavior
id: 8f3a1c2e-7b4d-4e9a-a1f5-hellonet0003
status: experimental
description: Detects HelloInjector-style process injection from ViPNet-context processes and HelloProxy-style internal proxying where a ViPNet-associated process spawns unexpected network listeners or child processes.
author: Security Arsenal Threat Intelligence
date: 2026/08/16
references:
- https://securelist.com/tr/hellonet-vipnet/120700/
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\ViPNet\'
- '\Infotecs\'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wscript.exe'
- '\cscript.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare administrative ViPNet diagnostic tooling spawning shells (investigate command lines)
level: high
tags:
- attack.t1055
- attack.t1090
- attack.t1059
KQL — Microsoft Sentinel / Defender
// HelloNet APT Hunt: rogue wtsapi32.dll loads, suspicious ViPNet child processes, and hash matches
let HelloNetHashes = dynamic([
"0cfdffc56f0fa325d0c4d24780b46597",
"16c211c96735f2fae9361b89bd7a31bf",
"1bfe2b9493128574907a8279256a8bcc",
"1bfe2b9493128574907a8279256a8bcc",
"41c938b3cd7e55d4077e34976929b140",
"6001829a128fe264b4403138700c11a8",
"9f5606a0755bc633b9bd7db6d179c09e",
"b103cd21280b4061f88b2bcc51394894",
"ee4ff46ddd8489e81447962f927bc3f6"
]);
let SuspiciousDllLoads = DeviceImageLoadEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "wtsapi32.dll"
| where FolderPath has_any ("ViPNet", "Infotecs")
| project TimeGenerated, DeviceName, FolderPath, FileName, MD5, InitiatingProcessFileName, InitiatingProcessCommandLine;
let HashHits = DeviceEvents
| where TimeGenerated > ago(30d)
| where MD5 in~ (HelloNetHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, MD5, ActionType;
let SuspiciousChildren = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFolderPath has_any ("ViPNet", "Infotecs")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath;
SuspiciousDllLoads
| union HashHits, SuspiciousChildren
| sort by TimeGenerated desc
PowerShell
# HelloNet IOC Hunt Script - Security Arsenal
# Checks for rogue wtsapi32.dll in ViPNet directories, known campaign hashes, and suspicious network listeners
$ErrorActionPreference = 'SilentlyContinue'
$KnownBadMD5 = @(
'0cfdffc56f0fa325d0c4d24780b46597',
'16c211c96735f2fae9361b89bd7a31bf',
'1bfe2b9493128574907a8279256a8bcc',
'41c938b3cd7e55d4077e34976929b140',
'6001829a128fe264b4403138700c11a8',
'9f5606a0755bc633b9bd7db6d179c09e',
'b103cd21280b4061f88b2bcc51394894',
'ee4ff46ddd8489e81447962f927bc3f6'
)
Write-Host "[+] HelloNet Hunt Started: $(Get-Date)" -ForegroundColor Cyan
$findings = @()
# 1. Locate ViPNet installation directories and check wtsapi32.dll
$ViPNetPaths = @(
"$env:ProgramFiles\Infotecs",
"${env:ProgramFiles(x86)}\Infotecs",
"$env:ProgramFiles\ViPNet",
"${env:ProgramFiles(x86)}\ViPNet"
)
foreach ($basePath in $ViPNetPaths) {
if (Test-Path $basePath) {
Write-Host "[+] Scanning ViPNet directory: $basePath"
$dlls = Get-ChildItem -Path $basePath -Recurse -Filter "wtsapi32.dll"
foreach ($dll in $dlls) {
$hash = (Get-FileHash -Path $dll.FullName -Algorithm MD5).Hash.ToLower()
$sig = Get-AuthenticodeSignature -FilePath $dll.FullName
$finding = [PSCustomObject]@{
Type = 'DLL_Sideload_Check'
Path = $dll.FullName
MD5 = $hash
Signed = $sig.Status
Malicious = ($KnownBadMD5 -contains $hash) -or ($sig.Status -ne 'Valid')
}
$findings += $finding
if ($finding.Malicious) {
Write-Host "[!] SUSPICIOUS: $($dll.FullName) MD5=$hash Sig=$($sig.Status)" -ForegroundColor Red
}
}
}
}
# 2. Sweep common staging locations for known hashes
$StagingPaths = @($env:TEMP, "$env:ProgramData", "$env:APPDATA")
foreach ($spath in $StagingPaths) {
Get-ChildItem -Path $spath -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
$h = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
if ($h -and ($KnownBadMD5 -contains $h.ToLower())) {
Write-Host "[!] KNOWN MALWARE HASH: $($_.FullName)" -ForegroundColor Red
$findings += [PSCustomObject]@{ Type='Hash_Match'; Path=$_.FullName; MD5=$h; Signed='N/A'; Malicious=$true }
}
}
}
# 3. Check for unexpected network listeners (HelloProxy behavior)
Write-Host "[+] Checking for suspicious listening ports tied to non-standard processes..."
Get-NetTCPConnection -State Listen | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
if ($proc -and $proc.Path -match 'Temp|AppData|ProgramData' ) {
Write-Host "[!] Suspicious listener: $($proc.ProcessName) ($($proc.Path)) on port $($_.LocalPort)" -ForegroundColor Yellow
$findings += [PSCustomObject]@{ Type='Suspicious_Listener'; Path=$proc.Path; MD5='N/A'; Signed='N/A'; Malicious=$true }
}
}
# 4. Export findings
$outFile = "$env:USERPROFILE\Desktop\HelloNet_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$findings | Export-Csv -Path $outFile -NoTypeInformation
Write-Host "[+] Hunt complete. Findings exported to $outFile" -ForegroundColor Cyan
if (-not $findings) { Write-Host "[+] No indicators found." -ForegroundColor Green }
Response Priorities
Immediate (0-4 hours):
- Push all 8+ MD5 indicators to EDR blocklists, email gateways, and web proxies; alert (not just log) on any hash execution.
- If your organization operates ViPNet software or has Russian-network business exposure: immediately audit every ViPNet installation directory for rogue
wtsapi32.dllfiles and validate digital signatures against vendor baselines. - Deploy the Sigma rules above to your SIEM and enable the image-load telemetry (Sysmon Event ID 7) required for sideload detection if not already collected.
- Isolate any host with a confirmed hash match from the network — do NOT reimage yet; HelloCleaner means forensic evidence may already be degraded.
24 hours:
- Run the KQL hunt across 30+ days of telemetry; expand retroactively if hits appear — supply chain intrusions frequently predate public disclosure by months.
- While this campaign is espionage-focused rather than credential-theft-focused, treat any confirmed-compromised host as fully exposed: rotate all credentials that transited or were stored on affected systems, including service accounts, and force re-authentication for any sessions originating from those hosts.
- Review internal network traffic between ViPNet hosts and other internal systems — HelloProxy means C2 traffic may never leave your perimeter in an obvious way.
- Engage your incident response retainer if any indicator matches; supply chain APT intrusions are not contained by endpoint cleanup alone.
1 week:
- Architectural hardening: segment ViPNet infrastructure and management servers into a dedicated, monitored zone with strict egress controls; the update mechanism must no longer be an unmonitored trusted channel.
- Implement application control with publisher + path rules (WDAC/AppLocker) that block unsigned DLL loads from application directories — this directly kills the T1574.002 persistence vector.
- Establish a vendor assurance process for ViPNet updates: verify update package signatures out-of-band before enterprise deployment, and subscribe to Infotecs security advisories.
- Conduct a threat hunt workshop on the full Securelist technical report, incorporating any published YARA rules into your scanning stack, and rehearse an IR playbook scenario for supply chain compromise.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.