HelloNet toolkit

tool · tool:hellonet-malware-suite single-source

Multi-component malware suite used in the HelloNet campaign: HelloInjector (DLL-sideload loader that injects into svchost.exe), HelloProxy (traffic proxy/loader hooking AFD IOCTLs via Microsoft Detours), HelloExecutor (shell-command backdoor), HelloCleaner (ViPNet log eraser) and HelloBackdoor (Rust file-transfer backdoor on TCP/443) (Kaspersky Securelist/GReAT, 2026-07-16).

Aliases: HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, HelloBackdoor

Coverage timeline

first 2026-07-17 → last 2026-07-19

Peak priority

notable

2 notable

Sources cited

1 hosts

Sections touched

research, weekly-research

Co-occurring entities

see Related entities below

ATT&CK techniques

pinned v19.2 · see below

2026-07-172 appearances2026-07-19

Hunting pivots

ATT&CK techniques

T1055 ×2 T1574.001 ×2 T1685 ×2 T1070 T1082 T1087.002 T1105 T1543.003 T1572 T1573.001

Affected products

InfoTeCS ViPNetViPNet

ATT&CK techniques

10 techniques observed across 2 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Execution TA0002

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

Persistence TA0003

T1543.003Create or Modify System Process: Windows Service×1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · ATT&CK page ↗

Privilege Escalation TA0004

T1055Process Injection×2

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×1

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · ATT&CK page ↗

Stealth TA0005

T1055Process Injection×2

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

T1070Indicator Removal×1

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Evidence: 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×2

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

Discovery TA0007

T1082System Information Discovery×1

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · ATT&CK page ↗

T1573.001Encrypted Channel: Symmetric Cryptography×1

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Evidence: 2026-07-19/weekly-w29-state-nexus-edr-blinding-tradecraft · ATT&CK page ↗

Story timeline

2026-07-19State-nexus tradecraft this week targeted defenders' own visibility — HelloNet blinds user-mode network EDR by intercepting raw AFD IOCTLs from a trusted-updater sideload, and GoSerpent shows weeks-long silent collection as deliberate design
weekly-researchAPT tradecraft targeting EDR visibility — HelloNet intercepts raw AFD IOCTLs via a ViPNet updater sideload; GoSerpent stages documents silently for weeks
2026-07-17Kaspersky: the HelloNet campaign blinds user-mode security tools by hooking raw AFD IOCTLs, persisting via DLL-sideload into a secure-network product's own auto-updater
researchHelloNet chains trusted-updater DLL sideloading with raw AFD-IOCTL interception to hide network C2 from user-mode EDR

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

used by

HelloNet
campaigncampaign:hellonet-vipnet-supply-chainevidence · 2026-07-17

Where this entity is cited

research1
weekly-research1

Source distribution

securelist.com2 (100%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

HelloNet×1
campaigncampaign:hellonet-vipnet-supply-chainlinked

All cited sources (2)

Entries about HelloNet toolkit (2)

2026-07-19 · view entry permalink →

NOTABLENATOB2

State-nexus tradecraft this week targeted defenders' own visibility — HelloNet blinds user-mode network EDR by intercepting raw AFD IOCTLs from a trusted-updater sideload, and GoSerpent shows weeks-long silent collection as deliberate design

Both of the week's notable APT disclosures share a target that is not the victim's data but the defender's ability to see the intrusion — worth surfacing together because the techniques transfer regardless of who was hit.

HelloNet blinds network EDR from below the API. Kaspersky GReAT documented an active campaign that persists by sideloading a malicious wtsapi32.dll into the auto-launched update component of the ViPNet secure-networking suite, then injects a proxy module (HelloProxy) into svchost.exe that uses Microsoft Detours to hook NtDeviceIoControlFile and intercept the raw Ancillary Function Driver IOCTLs — AFD_RECV, AFD_GET_TDI_HANDLES — which, per Kaspersky, hinders user-mode network-filtering security tools (Kaspersky, 2026-07-16). The significance for detection engineering is the layer: many endpoint tools observe network activity at the Winsock/API level, and an implant intercepting AFD IOCTLs is operating beneath that vantage, so it can proxy C2 traffic that user-mode network telemetry never records. Victimology is Russian government and CI (attributed with low confidence to an unknown Chinese-speaking group), but the technique is stack-agnostic.

GoSerpent makes dwell time a design choice. Kaspersky's analysis of the evolved GoSerpent backdoor — Go-based, used since 2021 against Southeast-Asian government and diplomatic entities — shows a chain that deploys a document-harvesting Windows service plus credential tools, then "deliberately waits a few weeks while files accumulate" before returning with the Stowaway proxy and a dedicated exfiltration toolset, talking ChaCha20 to its C2 (Kaspersky, 2026-07-16); Kaspersky notes a potential, unconfirmed link to the TetrisPhantom actor.

Defender takeaway

the transferable capability shift is HelloNet's AFD-IOCTL interception — detection engineers should not assume user-mode network telemetry is complete on a host, and should weight kernel-callback/driver-level and flow-based (network-appliance) telemetry accordingly, and treat DLL sideloading through a trusted security/VPN client's update mechanism as a live initial-foothold path (integrity-monitor the update components of trusted networking clients, not just the OS). GoSerpent's lesson is temporal: collection that stages silently for weeks defeats point-in-time and short-window alerting, so long-baseline hunts for a new persistent service writing to a staging directory, and for dormant footholds that only periodically beacon, are the counter. Triage: a signed networking client loading its own updater DLL is normal — the discriminator is that updater component making outbound connections it never made before, or a module in svchost.exe issuing raw AFD IOCTLs, and a newly-created Windows service that harvests documents but stays network-quiet for an extended period before any egress.

Builds on: 2026-07-17/kaspersky-hellonet-vipnet-updater-sideload-afd-ioctl · 2026-07-18/goserpent-backdoor-evolution-sea-government-diplomatic

research19 Jul 23:32Zsingle-sourceOpen finding ↗

Sources: Kaspersky Securelist (GReAT)

2026-07-17 · view entry permalink →

NOTABLENATOB2

Kaspersky: the HelloNet campaign blinds user-mode security tools by hooking raw AFD IOCTLs, persisting via DLL-sideload into a secure-network product's own auto-updater

Kaspersky's GReAT team detailed "HelloNet," an APT campaign (active since at least May 2026) that abuses the update mechanism of ViPNet — a Russian GOST-certified secure-networking suite — to persist inside targeted Russian government, energy, transport, education, logistics and industrial organizations (Kaspersky Securelist, 2026-07-16). The attackers drop a malicious wtsapi32.dll into the ViPNet update directory that the OS-start-launched updater itcsrvup64.exe sideloads. That loader ("HelloInjector") injects a second stage ("HelloProxy") into svchost.exe — but only after verifying the target's name is svchost.exe and its command line carries netsvcs. HelloProxy's distinguishing move is defense evasion at the socket layer: it uses the Microsoft Detours library to hook NtDeviceIoControlFile, closesocket and shutdown, intercepting the raw AFD IOCTL codes AFD_RECV (0x12017) and AFD_GET_TDI_HANDLES (0x12037) so that, in Kaspersky's words, it can "hinder security solutions operating in user mode for filtering network connections." It then acts as a traffic proxy or in-memory loader for further modules — recovered examples include "HelloExecutor" (shell-command execution) and "HelloCleaner" (deletes ViPNet log files to hide activity) — and on one host the operators opened an SSH reverse tunnel using a legitimate Plink binary renamed frontpage.exe.

Defender takeaway

for this constituency the ViPNet-specific vector is largely irrelevant, but two technique classes generalize directly. First, any third-party secure-network/VPN client with an auto-launched updater in a writable directory is a DLL-sideload persistence surface — treat vendor-updater directories as monitored locations where an unsigned or unexpected DLL write is high-signal. Second, AFD-IOCTL interception is a portable primitive for blinding user-mode network-filtering EDR; a Detours-style hook on NtDeviceIoControlFile in svchost.exe is worth surfacing regardless of the product being abused. Triage: a wtsapi32.dll written into a vendor's update directory has no legitimate reason to be there (the DLL belongs in System32); the vendor's own updater loading a DLL whose signature does not carry the vendor's publisher name, and a Plink/PuTTY binary identified by PE metadata rather than filename opening a -R port:addr:port tunnel, are the discriminators Kaspersky's hunt guidance keys on.

By placing the file in this directory, the attackers implement the DLL Sideloading technique — the ViPNet update system executable file itcsrvup64.exe, which is launched at OS startup, is susceptible to it.

These codes are used during socket operations — their interception allows the malware to hinder security solutions operating in user mode for filtering network connections.

At present, we link this campaign to the activities of an unknown Chinese-speaking APT group with a low degree of confidence.

Kaspersky Securelist (GReAT) 2026-07-16

research17 Jul 04:35Zsingle-sourceOpen finding ↗

Sources: Kaspersky Securelist (GReAT)