HelloNet APT Abuses ViPNet Update Mechanism to Backdoor Russian Government, Energy, and Transport Sectors

Kaspersky's Securelist disclosed the HelloNet campaign, active since at least May 2026, in which an advanced threat actor trojanizes the ViPNet VPN update directory with a malicious DLL (HelloInjector/wtsapi32.dll), sideloaded via the legitimate itcsrvup64.exe process to inject into svchost.exe. The toolset includes HelloProxy (in-memory C2), HelloExecutor (backdoor/reconnaissance), HelloBackdoor (Rust-based implant), and HelloCleaner (log wiper) — targeting Russian government, energy, transport, education, and logistics organizations. Kaspersky tentatively attributes the campaign to an unidentified Chinese-speaking APT with low confidence, explicitly noting the possibility of false flags.

Kaspersky tentatively attributes the campaign to an unidentified Chinese-speaking APT with low confidence, explicitly noting the possibility of false flags.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.