cyber.hendryadrian.com
Security News · bleepingcomputer.com

HelloNet Abuses ViPNet Updates to Target Russian Organizations

· Original article ↗

Summary

Kaspersky says HelloNet abuses the ViPNet update mechanism to deploy malware against Russian organizations, including government agencies. The campaign’s possible link to a Chinese-speaking APT is low confidence; initial access is unknown.

Key points

  • Kaspersky says HelloNet has been active since at least May and has affected organizations in government, energy, transport, education, and logistics.
  • Attackers reportedly place the malicious HelloInjector DLL in the local ViPNet Update System directory for sideloading by the legitimate itcsrvup64.exe at startup.
  • HelloInjector runs HelloProxy in memory; HelloProxy contacts a command-and-control server to obtain additional modules.
  • HelloExecutor can execute commands and conduct network reconnaissance; HelloCleaner removes ViPNet logs; HelloBackdoor supports file transfers and command execution.
  • Kaspersky does not explain how attackers gained access to modify files and does not claim ViPNet’s update infrastructure was compromised.
  • Kaspersky’s tentative attribution to an unidentified Chinese-speaking APT group is low confidence and could be a false flag; the cited indicators include an unused sina.com string and a malware mirror hosted by a Chinese university.
  • Kaspersky recommends monitoring ViPNet systems, particularly traffic on ports 5003, 5060, and 443.

Article Details

Event Type
Cyber intrusion campaign abusing the ViPNet update mechanism
Impact
Kaspersky reports that the campaign affected organizations in Russia’s government, energy, transport, education, and logistics sectors. The attackers reportedly sideloaded malware that injects into svchost.exe, retrieves additional modules from a C2 server, enables command execution and network reconnaissance, and removes ViPNet log data. Kaspersky’s possible attribution to a Chinese-speaking APT group is low confidence; the article says ViPNet’s update infrastructure itself was not claimed to be compromised.

MITRE ATT&CK

T1055 · Process InjectionHelloInjector injects its payload into svchost.exe.T1070 · Indicator RemovalHelloCleaner removes ViPNet log data to hide the activity.T1105 · Ingress Tool TransferHelloProxy contacts a C2 server to receive additional modules.T1574.002 · DLL Side-LoadingHelloInjector is sideloaded as a malicious DLL via the legitimate itcsrvup64.exe.

Threat Actors

HelloNetName used for the threat actor or campaign abusing the ViPNet update mechanism to target Russian organizations. Kaspersky tentatively links the activity to an unidentified Chinese-speaking APT group, but rates that attribution as low confidence and does not rule out a false flag.

Malware

HelloBackdoor#HelloNetHelloCleaner#HelloNetHelloExecutor#HelloNetHelloInjector#HelloNetHelloProxy#HelloNet

Vendors

InfoTeCS#HelloNet

Products

ViPNetA threat actor known as HelloNet is abusing the ViPNet update mechanism to target Russian organizations, including government agencies, by deploying malware that acts as a proxy, loader, and backdoor.

Countries

Chinawebsite sina.com and a malware download mirror hosted by the University of Science and Technology of China.RussiaThe tool is commonly used in Russia, where it is certified by the authorities for use in government and other regulated environments.

Industries

EducationAccording to Kaspersky researchers, HelloNet has impacted organizations in the government, energy, transport, education, and logistics sectors.EnergyAccording to Kaspersky researchers, HelloNet has impacted organizations in the government, energy, transport, education, and logistics sectors.GovernmentA threat actor known as HelloNet is abusing the ViPNet update mechanism to target Russian organizations, including government agencies, by deploying malware that acts as a proxy, loader, and backdoor.logisticsAccording to Kaspersky researchers, HelloNet has impacted organizations in the government, energy, transport, education, and logistics sectors.TransportAccording to Kaspersky researchers, HelloNet has impacted organizations in the government, energy, transport, education, and logistics sectors.