12 minhigh
HelloNet campaign — new malicious modules launched through the ViPNet update system
The HelloNet campaign is an active APT operation targeting large Russian organizations through the ViPNet secure networking software suite. Attackers achieve persistence by placing a malicious wtsapi32.dll in the ViPNet Update System directory, which is sideloaded by itcsrvup64.exe at OS startup. The loader (HelloInjector) injects into svchost.exe and deploys a modular toolkit including a network proxy, command executor, log cleaner, and a Rust-based backdoor. The campaign uses renamed PuTTY/Plink utilities for SSH reverse tunneling to C2 servers and employs IOCTL hooking to evade user-mode security solutions.
Sens:▲ 24h
Showing defanged values
- filenamefrontpage.exeRenamed PuTTY/Plink binary used for SSH reverse tunneling, dropped in C:\Users\Public\Music
- filenamepuh.exeHelloBackdoor dropper located in infotecs\vipnet client\ directory, also used to add Windows Defender exclusions
- filenametesh4RPC.txtLog file created by HelloProxy at C:\Users\Public\tesh4RPC.txt recording incoming AFD_RECV traffic with thread IDs and PIDs
- filenamewtsapi32.dllMalicious DLL sideloaded by ViPNet update process itcsrvup64.exe from C:\Program Files (x86)\InfoTeCS\VIPNet Update System — serves as HelloInjector loader
- ip176[.]32[.]34[.]135C2 server used for SSH reverse tunneling via renamed Plink (pagent.exe) on port 48022
- ip5[.]39[.]253[.]206C2 server used for SSH reverse tunneling via renamed Plink (frontpage.exe) on port 3522, and HelloBackdoor C2 communication
- md50cfdffc56f0fa325d0c4d24780b46597MD5 of malicious wtsapi32.dll (HelloInjector loader) variant
- md516c211c96735f2fae9361b89bd7a31bfMD5 of HelloBackdoor (Rust-based backdoor for file system manipulation)
- md51bfe2b9493128574907a8279256a8bccMD5 of HelloBackdoor variant
- md541c938b3cd7e55d4077e34976929b140MD5 of utility for adding exclusions to Windows Defender
- md56001829a128fe264b4403138700c11a8MD5 of HelloBackdoor dropper (infotecs\vipnet client\puh.exe)
- md59f5606a0755bc633b9bd7db6d179c09eMD5 of malicious wtsapi32.dll (HelloInjector loader) variant
- md5b103cd21280b4061f88b2bcc51394894MD5 of malicious wtsapi32.dll (HelloInjector loader) placed in ViPNet Update System directory for DLL sideloading persistence
- md5ee4ff46ddd8489e81447962f927bc3f6MD5 of HelloBackdoor dropper (infotecs\vipnet client\store.exe)
- md5f9eed2f0158dc98e7012fb809152209cMD5 of HelloBackdoor variant
- sha256e5621ffe4879f0ec39ed40f688db9399c2d43064d41ef14472fa335c4693b915SHA256 of renamed Plink binary (frontpage.exe) used for SSH reverse tunneling to C2 5.39.253.206, dropped in C:\Users\Public\Music
Detection / Hunteropenrouter
What Happened
A sophisticated hacking group has been targeting large Russian organizations since at least May 2026 by exploiting software called ViPNet, which is used to create secure computer networks. The attackers sneak their malicious code into the ViPNet update process so that every time the computer starts, the malware runs automatically. Once inside, the malware can relay network traffic, execute commands, clean up logs to hide its tracks, and manipulate files. The attackers also disguise legitimate remote-access tools by renaming them to avoid detection, then use them to create secret tunnels back to their own servers. The campaign appears to be linked to a Chinese-speaking hacking group, though this assessment is uncertain. Organizations using ViPNet should closely monitor their systems for unusual files in ViPNet directories, unexpected network connections on specific ports, and renamed remote-access tools.
Key Takeaways
- APT campaign abusing ViPNet update system (itcsrvup64.exe) for DLL sideloading persistence via malicious wtsapi32.dll
- Multi-module toolkit: HelloInjector (loader), HelloProxy (traffic proxy/loader), HelloExecutor (command execution), HelloCleaner (log wiping), HelloBackdoor (Rust-based file manipulation backdoor)
- HelloProxy hooks AFD_RECV and AFD_GET_TDI_HANDLES IOCTLs via Microsoft Detours to bypass user-mode network filtering and listens on ports 5003 and 5060 with custom handshake (0x0502 / ASDFASFSAFASDF)
- Attackers use renamed PuTTY/Plink binaries (frontpage.exe, pagent.exe) for SSH reverse tunneling to C2 infrastructure
- Attributed to an unknown Chinese-speaking APT group with low confidence based on embedded strings referencing sina.com and mirrors.ustc.edu.cn
Affected Systems
- Windows workstations running ViPNet software (ViPNet Update System, ViPNet Client, ViPNet Administrator)
- Russian organizations in government, energy, transport, education, logistics, and industry sectors
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access/Persistence: Malicious wtsapi32.dll placed in C:\Program Files (x86)\InfoTeCS\VIPNet Update System, sideloaded by itcsrvup64.exe at OS startup
- Execution: HelloInjector loader injects code into svchost.exe (netsvcs group) using NtWriteVirtualMemory and NtCreateThreadEx
- C2: HelloProxy hooks AFD_RECV/AFD_GET_TDI_HANDLES IOCTLs via Microsoft Detours, listens on ports 5003/5060 with custom handshake (0x0502 / ASDFASFSAFASDF)
- Discovery: HelloExecutor runs reconnaissance commands (query user, ipconfig, net user, dir listings of ViPNet directories)
- C2 Tunneling: Renamed Plink binaries (frontpage.exe, pagent.exe) create SSH reverse tunnels to C2 servers 5.39.253.206 and 176.32.34.135
- Defense Evasion: HelloCleaner wipes ViPNet log files; Windows Defender exclusions added via puh.exe; HelloBackdoor self-deletes via BAT file and restarts ViPNet service
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Kaspersky KEDR Expert, Kaspersky Anti Targeted Attack (KATA) NDR, Kaspersky Managed Detection and Response
Kaspersky KEDR Expert provides detection rules including using_plink_or_putty_for_port_forwarding and vipnet_load_library_code_injection. KATA NDR includes a Suricata IDS rule for HelloBackdoor activity on port 443. Kaspersky MDR provides behavioral indicators for DLL creation in ViPNet directories, atypical svchost.exe activity, and SSH tunnel detection. Rule bodies are not reproduced in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | The attack involves process injection from a signed ViPNet process into svchost.exe, DLL file creation in specific ViPNet directories, renamed PuTTY/Plink execution with distinctive command lines, and service creation — all of which are well-covered by EDR telemetry. Kaspersky KEDR Expert rules are explicitly described. |
| Network Visibility | Medium | HelloProxy listens on ports 5003 and 5060 with a custom handshake (0x0502 / ASDFASFSAFASDF), and HelloBackdoor listens on port 443 expecting activation string 47c6235b4d2611184. SSH reverse tunnels to known C2 IPs are detectable via NDR/IDS, but IOCTL hooking in user mode may bypass some network monitoring. |
| Detection Difficulty | Moderate | The attack uses legitimate signed ViPNet binaries and renamed legitimate tools, making purely signature-based detection insufficient. However, behavioral indicators such as itcsrvup64.exe injecting into svchost.exe, DLL creation in ViPNet directories, and SSH tunneling with port forwarding patterns are distinctive enough for reliable detection with EDR. |
Required Log Sources
- Windows process creation events (Sysmon Event ID 1 or equivalent EDR process telemetry)
- Windows process injection events (Sysmon Event ID 8 - CreateRemoteThread)
- Windows image load events (Sysmon Event ID 7 - ImageLoaded for DLL sideloading)
- Windows service creation/modification events (Event ID 7045, 7036)
- Windows registry modification events (Sysmon Event ID 12/13)
- Network connection events (Sysmon Event ID 3 or firewall logs)
- File creation events in ViPNet directories and C:\Users\Public
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for DLL files created in ViPNet software directories (InfoTeCS\VIPNet Update System, VIPNet Client) by processes other than the ViPNet installer, as this would indicate DLL sideloading persistence via T1574.002 | File creation events, process telemetry showing the creating process | Persistence | Low — legitimate ViPNet updates should be signed by InfoTeCS and originate from the update service, not arbitrary processes |
| Consider hunting for process injection events (CreateRemoteThread, NtWriteVirtualMemory) originating from itcsrvup64.exe or itcsrvup.exe targeting svchost.exe, as the ViPNet update process should not inject code into system processes | EDR process injection events, Sysmon Event ID 8, API call monitoring | Execution | Low — a legitimate software update component performing process injection into svchost.exe is highly anomalous |
| Consider hunting for renamed PuTTY or Plink binaries (identified by PE header, version info, or original filename) executing with command lines containing reverse port forwarding patterns (-R with port:address:port format) | Process creation events with command line, PE metadata/original filename fields | C2 Communication | Medium — legitimate administrators may use Plink for SSH tunneling, but renamed binaries with reverse tunnels to external IPs are suspicious |
| Consider hunting for network connections on ports 5003 and 5060 from host processes that also show evidence of IOCTL hooking or Detours library usage, as these are HelloProxy C2 listener ports | Network connection events, loaded module events showing Detours library | C2 Communication | Medium — these ports are not commonly used by standard applications but could appear in custom enterprise software |
| Consider hunting for the creation of the AppMgmt Windows service with a ServiceDll pointing to a non-standard DLL path, as attackers masquerade as legitimate Application Management service for persistence via T1543.003 | Windows service creation events (Event ID 7045), registry modification events for Services subkeys | Persistence | Low — the legitimate AppMgmt service uses a Microsoft-signed DLL in System32; a custom ServiceDll is highly suspicious |
Control Gaps
- Signature-based AV may miss the attack since it uses legitimate signed ViPNet binaries and renamed PuTTY/Plink tools
- User-mode network filtering solutions may be bypassed by HelloProxy's IOCTL hooking of AFD_RECV and AFD_GET_TDI_HANDLES
- Network IDS without application-layer inspection may not detect the custom handshake protocol on ports 5003/5060
- File integrity monitoring may not cover ViPNet installation directories by default
Key Behavioral Indicators
- Process ancestry: itcsrvup64.exe (or itcsrvup.exe) spawning or injecting into svchost.exe — this ViPNet component should not perform process injection
- DLL creation in C:\Program Files (x86)\InfoTeCS\VIPNet Update System or VIPNet Client directories by non-InfoTeCS-signed processes
- Renamed PuTTY/Plink binaries (original PE name mismatch) executing with -R flag for reverse port forwarding
- Creation of AppMgmt service with ServiceDll registry value pointing to a non-Microsoft DLL path
- File creation at C:\Users\Public\tesh4RPC.txt (HelloProxy traffic log)
- Executable files dropped in C:\Users\Public\Music directory
- Network connections to ports 5003, 5060, or 443 from host processes with unusual parent process chains
- BAT file execution that deletes a self-referencing executable and restarts the iplircontrol service (HelloBackdoor cleanup)
False Positive Assessment
Low — the combination of DLL creation in ViPNet directories, process injection from itcsrvup64.exe into svchost.exe, renamed Plink binaries with reverse SSH tunnels, and custom handshake protocols on non-standard ports creates a highly specific detection profile with minimal legitimate use cases.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching endpoints for wtsapi32.dll in ViPNet Update System directories and any files in C:\Users\Public\Music or C:\Users\Public\tesh4RPC.txt as indicators of compromise.
- Consider blocking network traffic to C2 IPs 5.39.253.206 and 176.32.34.135 at perimeter firewalls and proxy gateways if consistent with your network security policies.
- If your EDR supports host isolation, consider isolating any systems where itcsrvup64.exe is observed injecting into svchost.exe or where renamed Plink binaries are found executing reverse SSH tunnels.
- Consider reviewing Windows service configurations for any AppMgmt service instances with non-standard ServiceDll registry values pointing to attacker-controlled DLLs.
Infrastructure Hardening
- Consider implementing file integrity monitoring on ViPNet installation directories (C:\Program Files (x86)\InfoTeCS) to alert on unauthorized DLL or executable creation.
- Evaluate whether network segmentation can restrict outbound SSH connections from ViPNet workstations to only known and approved SSH gateways.
- Consider deploying NDR or IDS rules to detect the HelloBackdoor activation string (47c6235b4d2611184) on port 443 and the HelloProxy handshake (0x0502 / ASDFASFSAFASDF) on ports 5003 and 5060.
- If applicable, consider restricting the use of PuTTY/Plink utilities on ViPNet workstations or implementing application allowlisting that flags renamed binaries.
User Protection
- Consider ensuring endpoint protection is active on all ViPNet workstations with behavioral detection capabilities for process injection and DLL sideloading.
- Evaluate whether Windows Defender exclusions on ViPNet systems are minimal and monitored, as attackers used a utility (puh.exe) to add exclusions for their tooling.
- Consider deploying EDR coverage to all systems running ViPNet software if not already in place, prioritizing government, energy, transport, and logistics sector endpoints.
Security Awareness
- Consider incorporating awareness of supply chain and update system compromise scenarios into existing security training programs for IT teams managing ViPNet infrastructure.
- If your organization uses ViPNet, consider briefing system administrators on the indicators of this campaign so they can report anomalous files or service behavior through established channels.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping24 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Hashes:
9F5606A0755BC633B9BD7DB6D179C09E(MD5) - MD5 of malicious wtsapi32.dll (HelloInjector loader) variant0CFDFFC56F0FA325D0C4D24780B46597(MD5) - MD5 of malicious wtsapi32.dll (HelloInjector loader) variant16C211C96735F2FAE9361B89BD7A31BF(MD5) - MD5 of HelloBackdoor (Rust-based backdoor for file system manipulation)1BFE2B9493128574907A8279256A8BCC(MD5) - MD5 of HelloBackdoor variantf9eed2f0158dc98e7012fb809152209c(MD5) - MD5 of HelloBackdoor variant6001829A128FE264B4403138700C11A8(MD5) - MD5 of HelloBackdoor dropper (infotecs\vipnet client\puh.exe)EE4FF46DDD8489E81447962F927BC3F6(MD5) - MD5 of HelloBackdoor dropper (infotecs\vipnet client\store.exe)41c938b3cd7e55d4077e34976929b140(MD5) - MD5 of utility for adding exclusions to Windows Defender
- Registry Keys:
HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters- Registry key modified by attackers to register a malicious service DLL masquerading as legitimate Application Management service
- File Paths:
C:\Program Files (x86)\InfoTeCS\VIPNet Update System\wtsapi32.dll- Path where malicious HelloInjector DLL is dropped for DLL sideloading via itcsrvup64.exeC:\Users\Public\Music\frontpage.exe- Renamed Plink binary used for SSH reverse tunneling to C2C:\Users\Public\tesh4RPC.txt- HelloProxy log file recording incoming AFD_RECV traffic with thread IDs and PIDsinfotecs\vipnet client\store.exe- HelloBackdoor dropper path
- Command Lines:
- Purpose: SSH reverse tunneling to C2 server using renamed Plink binary | Tools:
frontpage.exe,Plink| Stage: C2 Communication |frontpage.exe -C -N -R 8443: - Purpose: SSH reverse tunneling to C2 server using renamed Plink binary (pagent.exe) | Tools:
pagent.exe,Plink| Stage: C2 Communication |pagent.exe -C -N -R 6443: - Purpose: Creating malicious Windows service masquerading as Application Management | Tools:
sc.exe| Stage: Persistence |sc create <servicename> binpath= - Purpose: Registering malicious DLL as service DLL for AppMgmt service | Tools:
reg.exe| Stage: Persistence |reg add HKLM\SYSTEM\CurrentControlSet\Services\AppMgmt\Parameters - Purpose: Adding Windows Defender exclusion for attacker tooling | Tools:
puh.exe| Stage: Defense Evasion |puh.exe add <path> white - Purpose: Extracting archived payload using 7-Zip | Tools:
7z.exe| Stage: Ingress Tool Transfer |7z.exe x <archive> -o
- Purpose: SSH reverse tunneling to C2 server using renamed Plink binary | Tools:
- Other:
ASDFASFSAFASDF- Handshake string expected by HelloProxy on ports 5003/5060 after sending 0x0502 to distinguish C2 traffic47c6235b4d2611184- Activation string (second half of MD5 hash of 'hello\n') expected by HelloBackdoor on port 443 to activate backdoorTrojan.Win32.Agentb.ttoe- Kaspersky detection verdict for HelloNet malwareTrojan.Win64.Convagent.gen- Kaspersky detection verdict for HelloNet malwareTrojan.Win64.Agent.smgpqx- Kaspersky detection verdict for HelloNet malwareHEUR:Trojan.Win64.DllHijacking.gen- Kaspersky heuristic detection verdict for DLL hijacking activity