Loading malware…
HelloProxy is a Windows in-memory malware component used in the HelloNet intrusion set against Russian organizations, particularly entities in government, energy, transport, education, logistics, and industrial sectors that use the ViPNet product suite. It functions as both a covert proxy and a loader for follow-on modules delivered from command-and-control infrastructure. In observed intrusions, HelloProxy was launched by the DLL-sideloaded first-stage loader HelloInjector after code injection into svchost.exe, forming part of a broader toolchain that also included HelloExecutor, HelloCleaner, and, in at least one case, the Rust-based HelloBackdoor.
Operationally, HelloProxy hides and relays attacker traffic while receiving additional payloads for in-memory execution. It hooks Windows networking functions and related socket-handling paths using Microsoft Detours, including interception of socket operations and device I/O control handling associated with network communications. This behavior is consistent with defense evasion and covert command-and-control support, and has been described as intended to hinder user-mode security monitoring of network connections. HelloProxy can also forward traffic between sockets, allowing it to act as an internal proxy for attacker communications.
As a loader, HelloProxy retrieves additional modules from the command server and executes them in memory. Observed follow-on payloads include HelloExecutor, used for command execution and reconnaissance, and HelloCleaner, used to remove ViPNet log data to conceal attacker activity. The broader campaign also deployed HelloBackdoor on at least one host for file transfer and command execution. HelloProxy therefore serves as a central staging and communications component within the malware ecosystem.
The malware has been associated with a cyber-espionage campaign active since at least May 2026 that abused the local ViPNet update mechanism through DLL sideloading. Attribution to a Chinese-speaking threat actor has been assessed only with low confidence and remains unconfirmed.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The deployed malware, HelloProxy, contacts a command-and-control server for additional modules like HelloExecutor (a backdoor) and HelloBackdoor (a Rust-based implant).
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Библиотека содержит загрузчик HelloInjector, который ищет процесс svchost.exe с параметром netsvcs, внедряет в него свой код и запускает в памяти следующий модуль — HelloProxy.
Библиотека содержит загрузчик HelloInjector, который ищет процесс svchost.exe с параметром netsvcs, внедряет в него свой код и запускает в памяти следующий модуль — HelloProxy.
SysExcSvc.dll, for receiving commands and exfiltrating their results back to Microsoft OneDrive cloud storage that's used as command-and-control (C2)
HelloProxy : payload exécuté en mémoire, agit comme proxy et contacte le C2 ... HelloBackdoor : implant écrit en Rust ... utilise le port 443
Next, HelloProxy hides traffic and pulls down more payloads.
Next, HelloProxy hides traffic and pulls down more payloads.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.