ViPNet Update System Abused to Deploy Five Malicious Modules

Jul 16, 2026 · Original article ↗

Summary

Researchers describe an active campaign since at least May 2026 that abuses the ViPNet update system to deploy five malicious modules, including a Rust backdoor. They link it with low confidence to an unknown Chinese-speaking APT group.

Key points

Researchers report targeted infection attempts against large Russian organizations in government, energy, transport, education, logistics, and industry; the campaign was still active at publication.
Attackers placed wtsapi32.dll in the ViPNet update directory for DLL sideloading. HelloInjector then injected code into svchost.exe and loaded payloads in memory.
HelloProxy intercepted socket-related functions and could act as a proxy or loader; it listened on ports 5003 and 5060 and used a handshake to identify command-server traffic.
HelloExecutor ran Windows commands to gather user, network, system, and ViPNet-directory information.
The Rust-based HelloBackdoor accepted connections on TCP port 443 and supported file upload, download, stopping the backdoor, and command execution.
Attackers used renamed PuTTY/Plink executables for SSH tunneling. Detection guidance recommends checking executable identity and command lines, as well as monitoring injection from ViPNet update processes.

Article Details

Attack Vectors: The attackers placed wtsapi32.dll in the ViPNet Update System directory so itcsrvup64.exe could load it at startup, establishing persistence through DLL sideloading.
HelloInjector searched for svchost.exe processes and injected code using NtWriteVirtualMemory and NtCreateThreadEx, then loaded payloads into memory.
HelloProxy intercepted socket-related functions, listened on ports 5003 and 5060, forwarded traffic, and could load executables received from the command server.
The attackers used a renamed PuTTY/Plink executable to create SSH reverse tunnels from infected systems to command-server infrastructure.
HelloBackdoor accepted TCP connections on port 443 and supported file upload, download, and stop commands.
Defensive Notes: Monitor network traffic on the ports identified in the report for signs of compromise.
Monitor creation of wtsapi32.dll in ViPNet directories and unusual or unsigned processes launched by ViPNet update processes.
Alert on process injection into svchost.exe originating from itcsrvup64.exe or itcsrvup.exe.
Detect renamed PuTTY/Plink binaries using their original PE filename, version information, strings, or hash, and review their command lines for port-forwarding patterns.
Ensure SIEM collection includes Windows Sysmon events 1, 7, and 11, and Security events 4688 and 4663, to support the described detection and hunting rules.

Indicators of compromise

Type	Indicator	Context
IPV4	`176[.]32[.]34[.]135`	Reported command-server endpoint used for an SSH tunnel from infected infrastructure.
IPV4	`5[.]39[.]253[.]206`	Reported command-server endpoint used for an SSH tunnel from infected infrastructure.
MD5	`0cfdffc56f0fa325d0c4d24780b46597`	MD5 hash listed for the malicious wtsapi32.dll loader.
MD5	`41c938b3cd7e55d4077e34976929b140`	MD5 hash of a utility reported as adding exclusions to Windows Defender.
MD5	`6001829a128fe264b4403138700c11a8`	MD5 hash of a HelloBackdoor dropper identified as infotecsvipnet clientpuh.exe.
MD5	`9f5606a0755bc633b9bd7db6d179c09e`	MD5 hash listed for the malicious wtsapi32.dll loader.
MD5	`b103cd21280b4061f88b2bcc51394894`	MD5 hash listed for the malicious wtsapi32.dll loader.
MD5	`ee4ff46ddd8489e81447962f927bc3f6`	MD5 hash of a HelloBackdoor dropper identified as infotecsvipnet clientstore.exe.
MD5	`f9eed2f0158dc98e7012fb809152209c`	MD5 hash listed for a HelloBackdoor sample.
SHA256	`16c211c96735f2fae9361b89bd7a31bf1bfe2b9493128574907a8279256a8bcc`	SHA-256 hash listed for a HelloBackdoor sample.