APT Campaign Hijacks ViPNet Update System to Deploy HelloNet Malware Across Russian Critical Sectors

APT Campaign Hijacks ViPNet Update System to Deploy HelloNet Malware Across Russian Critical Sectors

What Happened — Researchers at Kaspersky uncovered a new APT‑style campaign (named “HelloNet”) that injects malicious modules through the legitimate ViPNet software‑update component. The loader (HelloInjector) sideloads a malicious DLL, injects into svchost.exe, and then drops additional payloads (HelloProxy, HelloBackdoor) to enable persistence, traffic proxying, and file‑system manipulation.

Why It Matters for Compliance & Audit Readiness

• The technique exploits a trusted update mechanism, a classic control‑gap scenario that SOC 2 continuous‑compliance programs are designed to detect and evidence.
• Mapping this mis‑use to the Control Mapping control set (e.g., CC6.1 – Change Management, CC6.2 – Software Installation) provides audit‑ready proof that update pipelines are monitored and validated.
• Continuous evidence collection (e.g., hash verification of update binaries, integrity logs) can serve as defensible audit artifacts should regulators or customers inquire.

Who Is Affected — Large Russian organizations in government, energy, transport, education, logistics, and broader industry that rely on ViPNet for secure networking.

Recommended Actions

• Verify the integrity of all ViPNet update files (hash comparison, signed‑binary validation).
• Enforce strict change‑management controls around update‑system directories and binaries; log any additions to C:\Program Files (x86)\InfoTeCS\VIPNet Update System.
• Deploy continuous monitoring rules (e.g., DLL sideloading detection, unexpected svchost.exe injections) and retain logs as SOC 2 evidence.

Technical Notes

• Persistence via DLL sideloading of wtsapi32.dll in the ViPNet update folder.
• Loader uses NtWriteVirtualMemory and NtCreateThreadEx to inject into svchost.exe.
• Payloads include a Rust‑based backdoor (HelloBackdoor) for file‑system manipulation and a proxy tool (HelloProxy) for traffic forwarding.
• No public CVE; the vector is abuse of a trusted update mechanism rather than a software flaw.

Source: SecureList – HelloNet campaign