Threat Advisory • Attack Report • TLP: Red

HelloNet Campaign Targets Russian Infrastructure via ViPNet Update Abuse

HelloNet is an ongoing espionage campaign that abuses the trusted update mechanism of the ViPNet secure-networking suite to plant a modular implant chain inside large Russian government and critical-infrastructure organizations, gaining stealthy, persistent, high-privilege access while blending into legitimate software behavior.

Campaign: HelloNet Supply-Channel Abuse Low-Confidence Attribution TLP: Red Admiralty Code: A1 TA2026208

First Seen

May 2026

Targeted Country

Russia

Targeted Platform

Windows

Targeted Product

InfoTeCS ViPNet

Targeted Industries

Govt, Energy, Transport, Education, Logistics

Threat Actor

Unknown Chinese-speaking APT

Malware

HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, HelloBackdoor

Admiralty Code

A1

Date of Publication

July 22, 2026

TA Number

TA2026208

01 — Overview

Summary

HelloNet is an ongoing espionage campaign, active since at least May 2026, that abuses the trusted update mechanism of the ViPNet secure-networking suite to plant a modular implant chain inside large Russian government and critical-infrastructure organizations. By sideloading a malicious DLL through a signed ViPNet update process, the HelloNet operators gain stealthy, persistent, high-privilege access while blending into legitimate software behavior, then use purpose-built tools to proxy traffic, run reconnaissance, tunnel data out over SSH, and scrub logs to cover their tracks.

Attribution for the HelloNet campaign is low confidence, tentatively pointing to a Chinese-speaking group based on soft artifacts. The campaign's abuse of a security product's own update pipeline makes it a serious supply-of-trust threat that conventional signature- and vulnerability-based defenses are unlikely to catch.

02 — Intrusion Timeline

Attack Details

#1 Weaponizing a Trusted Security Product

HelloNet is an advanced persistent threat campaign disclosed in public reporting on 16 July 2026, notable for weaponizing a trusted security product against the very organizations it is meant to protect. Rather than exploiting a vulnerability, the HelloNet operators abused the update mechanism of ViPNet, a secure-networking software suite, to deliver a modular implant chain into large enterprises. The campaign has been active since at least May 2026 and remained ongoing at the time of publication.

#2 A Supply-Channel and Living-off-Trust Attack

At its core, the HelloNet operation is a supply-channel and living-off-trust attack. ViPNet is widely deployed to build encrypted networks across government and critical infrastructure, so its update system is inherently trusted and its executables are digitally signed. By inserting themselves into this pipeline, the attackers gained a stealthy, high-privilege foothold that blends with legitimate software behavior, a pattern already observed a year earlier when a ViPNet-mimicking backdoor was documented, signaling sustained adversary interest in this vector.

#3 HelloInjector Sideloads Through the Signed Update Binary

The HelloNet attack chain begins with a malicious wtsapi32.dll planted in the ViPNet Update System directory, which is sideloaded by the signed update binary itcsrvup64.exe at system startup, establishing persistence through a trusted process. This loader, HelloInjector, injects a payload into a netsvcs svchost.exe instance using native NT APIs (NtWriteVirtualMemory, NtCreateThreadEx).

#4 HelloProxy, HelloExecutor, HelloBackdoor, and HelloCleaner

The main HelloNet payload, HelloProxy, hooks network-related APIs using a legitimate API-hooking library and intercepts AFD IOCTLs to hinder user-mode security tools, while listening on ports 5003 and 5060 behind a handshake-gated C2. From there, HelloExecutor performs internal reconnaissance and harvests ViPNet Administrator and Client export paths, a Rust-based HelloBackdoor on port 443 enables command execution and file transfer, and an SSH reverse tunnel via a renamed legitimate tunneling utility provides persistent egress. Finally, HelloCleaner scrubs ViPNet log files to erase traces, delivering impact through persistent remote access and anti-forensic cleanup.

#5 Targeting and Attribution

HelloNet targeting spans government, energy, transport, education, logistics, and industry, a critical-infrastructure footprint concentrated on large Russian organizations. Attribution remains low confidence: reporting tentatively points to an unknown Chinese-speaking group based on two soft artifacts, both flagged as possibly unintentional with false flags not excluded.

#6 A Disciplined, Trust-Abusing Intrusion Set

In conclusion, HelloNet is a disciplined, trust-abusing intrusion set built for stealth, persistence, and cleanup rather than noise. Defenders should prioritize hunting for anomalous wtsapi32.dll in the ViPNet directory, detecting renamed tunneling binaries on their original PE metadata, and monitoring the handshake-gated C2 patterns on ports 5003/5060 and the HelloBackdoor activation string on port 443.

03 — Mitigation

Recommendations

Restrict and Monitor the ViPNet Update Directory

Treat C:\Program Files (x86)\InfoTeCS\VIPNet Update System as a high-value path and alert on the creation of any .dll or .exe there, especially wtsapi32.dll, that lacks a valid InfoTeCS signature, since the HelloNet attackers persist by sideloading an unsigned DLL into the update service.

Validate ViPNet Update Process Signatures

Detect launches of Itcsrvup64.exe or Itcsrvup.exe that carry an invalid signature or a signature without InfoTeCS as the manufacturer, and flag any child processes these update executables spawn that are not the expected ViPNet binaries (wmail, monitor, itcsrvup64).

Hunt for svchost Injection from the Update Service

Monitor for process injection into svchost.exe originating from itcsrvup64.exe, which is the core behavior of HelloInjector; the legitimate ViPNet update component has no reason to write memory into system processes.

Alert on Anomalous svchost Behavior

Watch for svchost.exe instances spawning reconnaissance commands (net use/group, sc query/start/stop, ping, ipconfig, netstat) or performing file and process creation, as HelloExecutor operates from within an injected svchost context.

Detect Renamed PuTTY/Plink Tunnels

Identify SSH tunneling tools by their original PE metadata rather than filename, since the HelloNet operators renamed Plink/PuTTY to frontpage.exe and pagent.exe; alert on command lines containing reverse-forward patterns such as port:address:port regardless of the executable name.

Block and Watch Known C2 Infrastructure

Block outbound connections to 5[.]39[.]253[.]206 and 176[.]32[.]34[.]135 and inspect for the non-standard tunnel and listener ports (5003, 5060, 443 with the HelloBackdoor activation string) referenced in this HelloNet advisory.

Adopt a Layered Detection Architecture

Combine endpoint (EDR), network (NDR/IDS), and SIEM detections to catch this intrusion set across its lifecycle, since no single stage of HelloNet — sideloading, injection, tunneling, or C2 — is reliably visible from one control alone.

04 — Adversary Tradecraft

Potential MITRE ATT&CK TTPs

T1574.002

Persistence

T1574: Hijack Execution Flow — DLL Side-Loading

T1543.003

Persistence

T1543: Create or Modify System Process — Windows Service

T1055

Defense Evasion

Process Injection

T1036.005

Defense Evasion

T1036: Masquerading — Match Legitimate Name or Location

T1562.001

Defense Evasion

T1562: Impair Defenses — Disable or Modify Tools

T1070.004

Defense Evasion

T1070: Indicator Removal — File Deletion

T1112

Defense Evasion

Modify Registry

T1218

Defense Evasion

System Binary Proxy Execution

T1059.003

Execution

T1059: Command and Scripting Interpreter — Windows Command Shell

T1569.002

Execution

T1569: System Services — Service Execution

T1016

Discovery

System Network Configuration Discovery

T1018

Discovery

Remote System Discovery

T1082

Discovery

System Information Discovery

T1057

Discovery

Process Discovery

T1007

Discovery

System Service Discovery

T1083

Discovery

File and Directory Discovery

T1005

Collection

Data from Local System

T1074.001

Collection

T1074: Data Staged — Local Data Staging

T1105

Command and Control

Ingress Tool Transfer

T1090

Command and Control

Proxy

T1572

Command and Control

Protocol Tunneling

T1021.004

Lateral Movement

T1021: Remote Services — SSH

05 — Indicators

Indicators of Compromise (IOCs)

Type	Value
MD5	`16C211C96735F2FAE9361B89BD7A31BF`
MD5	`1BFE2B9493128574907A8279256A8BCC`
MD5	`f9eed2f0158dc98e7012fb809152209c`
MD5	`6001829A128FE264B4403138700C11A8`
MD5	`EE4FF46DDD8489E81447962F927BC3F6`
MD5	`41c938b3cd7e55d4077e34976929b140`
MD5	`B103CD21280B4061F88B2BCC51394894`
MD5	`9F5606A0755BC633B9BD7DB6D179C09E`
MD5	`0CFDFFC56F0FA325D0C4D24780B46597`
SHA256	`68b4c76a2280e3c31130d4de12b12dfd479a476f347f5b4a58cb2483d74aba7e`
SHA256	`ffdc194775b2904564bbbd1cf0eb01d1a01f83ef5197d1612b6e2d69de7a4732`
IPv4	`5[.]39[.]253[.]206`
IPv4	`176[.]32[.]34[.]135`
Filename	`wtsapi32.dll`
Filename	`puh.exe`
Filename	`store.exe`
Filename	`frontpage.exe`
Filename	`pagent.exe`
File Path	`C:\users\public\music\frontpage.exe`
File Path	`C:\users\public\tesh4RPC.txt`
File Path	`infotecs\vipnet client\puh.exe`
File Path	`infotecs\vipnet client\store.exe`

06 — Sources

References

https://securelist.com/tr/hellonet-vipnet/120700/

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro.