Malware

HelloProxy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1055Process InjectionEvidence2

If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions.

Stealth

1 technique

T1055Process InjectionEvidence2

If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

После установки перехватчиков, вредонос начинает прослушивать порты 5003 и 5060 в ожидании первых команд от С2 сервера. Для того, чтобы отличить трафик командного сервера от остального трафика, имплант реализует процесс рукопожатия: отправляет два байта 0x0502 через сокет и ожидает получить сообщение, содержащее строку ASDFASFSAFASDF.

T1090ProxyEvidence2

Working as a proxy. The malware accepts strings in the following format: Afterwards, it creates new sockets and starts forwarding traffic between them.

T1105Ingress Tool TransferEvidence2

Working as a loader. The malware accepts an executable file from the command server, after which it loads it into the memory of its own process and launches it in a separate thread.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelist ruNews

Jul 16, 2026

Кампания HelloNet: атаки через систему обновления ViPNet | Securelist

A covert proxy and loader that hooks NtDeviceIoControlFile, closesocket, and shutdown using Detours, listens on ports 5003 and 5060, performs a custom handshake, proxies traffic, and can receive and execute additional payloads in memory from C2.

securelistNews

Jul 16, 2026

HelloNet campaign: a threat via the ViPNet update system | Securelist

An in-memory implant that hooks NtDeviceIoControlFile, closesocket, and shutdown using Microsoft Detours, listens on ports 5003 and 5060, performs a custom handshake, proxies traffic, and loads additional payloads received from C2.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

HelloProxy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1055Process InjectionEvidence2

If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions.

Stealth

1 technique

T1055Process InjectionEvidence2

If such a process is found, the loader injects itself into the target process using the NtWriteVirtualMemory and NtCreateThreadEx functions.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

T1090ProxyEvidence2

Working as a proxy. The malware accepts strings in the following format: Afterwards, it creates new sockets and starts forwarding traffic between them.

T1105Ingress Tool TransferEvidence2

Working as a loader. The malware accepts an executable file from the command server, after which it loads it into the memory of its own process and launches it in a separate thread.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

securelist ruNews

Jul 16, 2026

Кампания HelloNet: атаки через систему обновления ViPNet | Securelist

securelistNews

Jul 16, 2026

HelloNet campaign: a threat via the ViPNet update system | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.