HelloNet campaign abuses ViPNet update mechanism to target Russian organizations

An advanced threat actor, dubbed HelloNet, is abusing the update mechanism for the ViPNet private networking product suite to target Russian organizations, including government agencies. The campaign has been active since at least May, deploying a malicious payload that acts as a proxy and loader for additional malware. According to Kaspersky researchers, HelloNet has impacted organizations in the government, energy, transport, education, and logistics sectors, with further coverage provided by Bleeping Computer.

The HelloNet campaign targets organizations using ViPNet, a Russian information-security product suite commonly used in government and regulated environments. Attackers place a malicious DLL file, HelloInjector, within the ViPNet Update System directory. This file is then sideloaded at startup, injecting into the svchost.exe process to gain elevated privileges and persistence. While the initial access method is not detailed, it's noted that ViPNet's update infrastructure itself may not have been compromised.

The deployed malware, HelloProxy, contacts a command-and-control server for additional modules like HelloExecutor (a backdoor) and HelloBackdoor (a Rust-based implant). A tool called HelloCleaner is also used to erase ViPNet log data. Kaspersky tentatively attributes the campaign to an unidentified Chinese-speaking APT group but notes low confidence due to weak evidence. Security teams are advised to monitor ViPNet systems for suspicious traffic on specific ports.

Source: Bleeping Computer