Loading malware…
HelloCleaner is a Windows malware component used in the HelloNet intrusion set to erase ViPNet software log data and reduce forensic visibility after compromise. It has been observed in campaigns targeting large Russian organizations, including entities in government, energy, transport, education, logistics, industrial, IT, electronics, instrumentation, and software development sectors. The broader activity abuses the ViPNet update mechanism through DLL sideloading of a malicious loader, after which additional modules are deployed for proxying, command execution, reconnaissance, tunneling, and backdoor access.
Within this toolchain, HelloCleaner functions as a cleanup and anti-forensics module rather than a primary access implant. Its role is to remove ViPNet log files and conceal attacker actions on infected systems, supporting post-compromise stealth and defense evasion. It has been associated with companion components including HelloInjector, HelloProxy, HelloExecutor, and in some cases HelloBackdoor. Reporting has tentatively linked the overall campaign with low confidence to an unidentified Chinese-speaking threat actor, though that attribution remains uncertain and possible false-flag activity has been noted.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Он ищет процесс, имя которого содержит строку svchost, а командная строка — строку netsvcs. Если такой процесс найден, загрузчик внедряет себя в целевой процесс с помощью функций NtWriteVirtualMemory и NtCreateThreadEx.
Он ищет процесс, имя которого содержит строку svchost, а командная строка — строку netsvcs. Если такой процесс найден, загрузчик внедряет себя в целевой процесс с помощью функций NtWriteVirtualMemory и NtCreateThreadEx.
HelloCleaner, to clean ViPNet software log files and erase forensic trail
Meanwhile, HelloCleaner wipes ViPNet log files to cover tracks.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.