HelloNet Campaign Targets ViPNet Update Systems

Since at least May 2026, a sophisticated APT campaign dubbed 'HelloNet' has targeted large Russian organizations across government, energy, transport, and industrial sectors. The attackers achieve persistence by utilizing DLL sideloading within the ViPNet secure networking software suite, specifically targeting the update system component to execute malicious payloads.

The attack chain involves a multi-stage deployment of modular malware: HelloInjector (a loader), HelloProxy (a traffic proxy and module loader), and HelloBackdoor (a Rust-based implant). These tools enable the attackers to execute remote commands, manipulate file systems, and tunnel traffic via SSH, all while attempting to evade detection by hooking network-related system calls.

Attribution points toward a Chinese-speaking threat actor based on artifacts such as strings referencing Chinese news portals and the use of Chinese university mirrors for Rust package compilation, though researchers note these could be intentional false flags.