State-nexus tradecraft this week targeted defenders' own visibility — HelloNet blinds user-mode network EDR by intercepting raw AFD IOCTLs from a trusted-updater sideload, and GoSerpent shows weeks-long silent collection as deliberate design
Both of the week's notable APT disclosures share a target that is not the victim's data but the defender's ability to see the intrusion — worth surfacing together because the techniques transfer regardless of who was hit.
HelloNet blinds network EDR from below the API. Kaspersky GReAT documented an active campaign that persists by sideloading a malicious wtsapi32.dll into the auto-launched update component of the ViPNet secure-networking suite, then injects a proxy module (HelloProxy) into svchost.exe that uses Microsoft Detours to hook NtDeviceIoControlFile and intercept the raw Ancillary Function Driver IOCTLs — AFD_RECV, AFD_GET_TDI_HANDLES — which, per Kaspersky, hinders user-mode network-filtering security tools (Kaspersky, 2026-07-16). The significance for detection engineering is the layer: many endpoint tools observe network activity at the Winsock/API level, and an implant intercepting AFD IOCTLs is operating beneath that vantage, so it can proxy C2 traffic that user-mode network telemetry never records. Victimology is Russian government and CI (attributed with low confidence to an unknown Chinese-speaking group), but the technique is stack-agnostic.
GoSerpent makes dwell time a design choice. Kaspersky's analysis of the evolved GoSerpent backdoor — Go-based, used since 2021 against Southeast-Asian government and diplomatic entities — shows a chain that deploys a document-harvesting Windows service plus credential tools, then "deliberately waits a few weeks while files accumulate" before returning with the Stowaway proxy and a dedicated exfiltration toolset, talking ChaCha20 to its C2 (Kaspersky, 2026-07-16); Kaspersky notes a potential, unconfirmed link to the TetrisPhantom actor.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Persistence TA0003
T1543.003Create or Modify System Process: Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Privilege Escalation TA0004
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1543.003Create or Modify System Process: Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Stealth TA0005
T1055Process Injection
Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Defense Impairment TA0112
T1685Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
Command and Control TA0011
T1573.001Encrypted Channel: Symmetric Cryptography
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.