Loading malware…
HelloBackdoor is a Rust-based backdoor associated with the HelloNet intrusion set targeting Russian organizations. It has been observed in campaigns abusing the ViPNet update mechanism, where attackers used DLL sideloading through a malicious component loaded by a legitimate ViPNet updater process to establish persistence and launch additional malware modules. Within this toolchain, HelloBackdoor appears as a later-stage implant deployed alongside components such as HelloInjector, HelloProxy, HelloExecutor, and HelloCleaner.
The malware provides remote command execution and bidirectional file transfer, allowing operators to upload and download files and execute arbitrary commands through the Windows command interpreter. Reporting also indicates it can terminate itself on command. Its role in the broader operation is consistent with post-compromise access, hands-on-keyboard activity, and data movement after an initial foothold has been established.
HelloBackdoor has been documented on compromised Windows systems in Russian government, energy, transport, education, logistics, and industrial environments. The broader campaign has been characterized as cyber-espionage. Attribution to a Chinese-speaking threat actor has been assessed only with low confidence, and false-flag possibilities have been noted, so actor attribution remains unconfirmed.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The deployed malware, HelloProxy, contacts a command-and-control server for additional modules like HelloExecutor (a backdoor) and HelloBackdoor (a Rust-based implant).
6 distinct techniques documented for this family, organized by ATT&CK tactic.
HelloExecutor : backdoor permettant l’exécution de commandes ... HelloBackdoor ... supporte l’exécution de commandes
Commands that do not match a predefined format are interpreted as instructions to be executed via "cmd.exe."
SysExcSvc.dll, for receiving commands and exfiltrating their results back to Microsoft OneDrive cloud storage that's used as command-and-control (C2)
HelloProxy : payload exécuté en mémoire, agit comme proxy et contacte le C2 ... HelloBackdoor : implant écrit en Rust ... utilise le port 443
The deployed malware, HelloProxy, contacts a command-and-control server for additional modules like HelloExecutor (a backdoor) and HelloBackdoor (a Rust-based implant).
As a result, stolen data and remote access flowed through trusted-looking traffic.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.