Loading story…
Researchers reported an active HelloNet intrusion campaign targeting large Russian organizations in government, energy, transport, education, logistics, and industrial sectors by abusing the InfoTeCS ViPNet Update System. The attackers gained persistence through DLL sideloading, placing a malicious wtsapi32.dll alongside itcsrvup64.exe in the ViPNet update directory, then injecting code into svchost.exe to launch a previously undocumented toolset: HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, and the Rust-based HelloBackdoor. The malware supported reconnaissance, payload loading, proxying, file operations, and log wiping, including deletion of ViPNet traces to hinder investigation.
The operation has been active since at least May 2026 and used command infrastructure including 5.39.253[.]206 and 176.32.34[.]135, with operators also creating an SSH tunnel via a renamed PuTTY binary. Researchers said the backdoor listened on ports 5003 and 5060, used a custom handshake containing ASDFASFSAFASDF, and interfered with user-mode network monitoring by intercepting socket-related functions and IOCTLs. Attribution remains low confidence, with limited artifacts such as references to sina.com and use of a Chinese Rust crate mirror suggesting, but not proving, a Chinese-speaking APT actor; defenders were urged to review IoCs and closely monitor ViPNet-connected systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Securelist published a technical report describing the HelloNet campaign's use of DLL sideloading via a malicious wtsapi32.dll alongside itcsrvup64.exe, plus tools including HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, and HelloBackdoor. The report also shared infrastructure details, detection guidance, and a low-confidence assessment linking the activity to an unknown Chinese-speaking APT group.
Researchers said the active APT campaign had been underway since at least May 2026, targeting large Russian organizations in government, energy, transport, education, logistics, and industrial sectors. The attackers abused the ViPNet update system to gain persistence and execute malware.
During an April 2025 cyberincident investigation, Kaspersky GReAT identified a backdoor targeting large Russian organizations and delivered via LZH archives disguised as ViPNet updates. The malware abused the ViPNet update service to launch a malicious loader and in-memory backdoor capable of C2 communications, file theft, and deploying additional components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourcexakep.ru
Open sourcesecurelist.com
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
A phishing campaign tracked as **VENOMOUS#HELPER** has compromised more than 80 organizations since at least April 2025, primarily in the United States, with additional victims in Western Europe and Latin America. Attackers used emails impersonating the U.S. Social Security Administration to drive targets to fake SSA pages hosted via compromised legitimate websites, including a Mexican domain used to help evade filtering. Victims who downloaded the fake SSA statement executable installed vendor-signed remote monitoring and management tools instead of conventional malware, giving the operators covert access through **SimpleHelp** and **ConnectWise ScreenConnect**. Researchers said the malware chain deployed a self-hosted **SimpleHelp 5.0.1** instance packaged with JWrapper and a separate ScreenConnect relay, creating redundant remote access if one channel was blocked. The installed tooling persisted as a Windows service, survived Safe Mode, polled for Wi-Fi status, firewall state, security products, user activity, and mouse movement, and in some cases renamed `wmic.exe` to evade name-based detections. Separate infrastructure analysis linked a signed SimpleHelp client to a five-server command-and-control cluster on `147.45.218.0/24`, a Russian-language portal at `dangerstock[.]online`, and an exposed Cockpit dashboard, with Fortinet tracking the infrastructure as **PALLASNET.M**; Securonix assessed the broader activity as consistent with a financially motivated initial access broker or ransomware precursor.
Jun 29, 2026
A China-linked advanced persistent threat (APT) group infiltrated a U.S. non-profit organization focused on influencing U.S. government policy on international issues, maintaining access for several weeks in April 2025. The attackers initiated their campaign with mass scanning on April 5, targeting a server using multiple public exploits, including those for Log4j, Atlassian OGNL, Apache Struts, and GoAhead Web Server. After a brief pause, activity resumed on April 16 with connectivity tests and network reconnaissance, followed by the establishment of persistence through a scheduled task that executed `msbuild.exe` as SYSTEM every hour. This task likely injected code into `csc.exe`, which then communicated with a command-and-control server at `38.180.83[.]166`. The attackers also used DLL sideloading via the legitimate VipreAV component `vetysafe.exe` to load a malicious DLL (`sbamres.dll`), a technique previously associated with other Chinese APT groups. The intrusion demonstrated a focus on stealth and long-term access, with the use of legitimate binaries and scheduled tasks to evade detection. The attackers' tactics, including the use of `Imjpuexc` (a Microsoft file for East Asian input) to mask activity and the deployment of a custom loader to execute an encrypted payload (likely a remote access trojan) in memory, align with methods seen in other campaigns attributed to Chinese state-sponsored actors. The operation is part of a broader pattern of Chinese cyber-espionage targeting U.S. organizations involved in policy matters, leveraging both legacy and recent vulnerabilities to gain initial access and maintain persistence within high-value networks.
Jun 29, 2026