HelloNet APT Abused ViPNet Update System to Backdoor Russian Organizations
Threat Actor Intelligence · 8 sources · Updated 4mo ago · First seen Jul 16, 2026
Researchers reported an active HelloNet intrusion campaign targeting large Russian organizations in government, energy, transport, education, logistics, and industrial sectors by abusing the InfoTeCS ViPNet Update System. The attackers gained persistence through DLL sideloading, placing a malicious wtsapi32.dll alongside itcsrvup64.exe in the ViPNet update directory, then injecting code into svchost.exe to launch a previously undocumented toolset: HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, and the Rust-based HelloBackdoor. The malware supported reconnaissance, payload loading, proxying, file operations, and log wiping, including deletion of ViPNet traces to hinder investigation.
The operation has been active since at least May 2026 and used command infrastructure including 5.39.253[.]206 and 176.32.34[.]135, with operators also creating an SSH tunnel via a renamed PuTTY binary. Researchers said the backdoor listened on ports 5003 and 5060, used a custom handshake containing ASDFASFSAFASDF, and interfered with user-mode network monitoring by intercepting socket-related functions and IOCTLs. Attribution remains low confidence, with limited artifacts such as references to sina.com and use of a Chinese Rust crate mirror suggesting, but not proving, a Chinese-speaking APT actor; defenders were urged to review IoCs and closely monitor ViPNet-connected systems.
