--- title: HelloNet campaign: a threat via the ViPNet update system description: Kaspersky researchers uncovered an active APT campaign dubbed HelloNet, targeting large Russian organizations in government, energy, transport, education, and... canonical: https://daily.dev/posts/hellonet-campaign-a-threat-via-the-vipnet-update-system-umosqehh5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HelloNet campaign: a threat via the ViPNet update system | daily.dev og:description: Kaspersky researchers uncovered an active APT campaign dubbed HelloNet, targeting large Russian organizations in government, energy, transport, education, and... og:url: https://daily.dev/posts/hellonet-campaign-a-threat-via-the-vipnet-update-system-umosqehh5 og:image: https://api.daily.dev/og/posts/umOSqehh5.png og:image:alt: HelloNet campaign: a threat via the ViPNet update system og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HelloNet campaign: a threat via the ViPNet update system **[Securelist](https://daily.dev/sources/securelist)** · 10 min read · 0 upvotes · 0 comments ## Summary Kaspersky researchers uncovered an active APT campaign dubbed HelloNet, targeting large Russian organizations in government, energy, transport, education, and logistics sectors. Attackers exploit the ViPNet secure network software's update system via DLL sideloading (malicious wtsapi32.dll) to achieve persistence. The toolset includes HelloInjector (a loader injecting into svchost.exe), HelloProxy (a traffic proxy and payload loader using IOCTL interception via Microsoft Detours), HelloExecutor (a reconnaissance backdoor), HelloCleaner (a log-wiping module), and HelloBackdoor (a Rust-based backdoor on port 443 supporting file upload/download and command execution). Attackers used renamed PuTTY/Plink binaries for SSH tunneling. Attribution points tentatively to a Chinese-speaking APT group based on references to sina.com and Rust crate mirrors from USTC, though false flags cannot be ruled out. Detailed IoCs, MITRE ATT&CK TTPs, and detection rules for Kaspersky KEDR Expert and KATA NDR are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [NightEagle APT targets Russian organizations](https://daily.dev/posts/nighteagle-apt-targets-russian-organizations-iwfyae99j) · Securelist · 0 upvotes · 0 comments - [Chinese hackers hijack auth flow, spy on isolated network for a decade](https://daily.dev/posts/chinese-hackers-hijack-auth-flow-spy-on-isolated-network-for-a-decade-yeupuqtg0) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/hellonet-campaign-a-threat-via-the-vipnet-update-system-umosqehh5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HelloNet campaign: a threat via the ViPNet update system","url":"https://daily.dev/posts/hellonet-campaign-a-threat-via-the-vipnet-update-system-umosqehh5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hellonet-campaign-a-threat-via-the-vipnet-update-system-umosqehh5"},"datePublished":"2026-07-16T14:49:45.504Z","dateModified":"2026-07-19T14:36:09.339Z","description":"Kaspersky researchers uncovered an active APT campaign dubbed HelloNet, targeting large Russian organizations in government, energy, transport, education, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecce9bd110df8162ff26390483e70eb0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecce9bd110df8162ff26390483e70eb0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hellonet-campaign-a-threat-via-the-vipnet-update-system-umosqehh5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,rust,malware","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"HelloNet campaign: a threat via the ViPNet update system"}]} ```