This threat involves a sophisticated APT campaign leveraging the ViPNet update system to deliver a multi-component malware suite. Persistence is maintained through DLL sideloading of a malicious wtsapi32.dll within ViPNet directories. The malware suite includes HelloInjector (loader), HelloProxy (traffic proxy and payload delivery), HelloExecutor (command execution backdoor), HelloCleaner (log sanitization), and HelloBackdoor (Rust-based file manipulation). The attackers conduct reconnaissance, establish SSH tunnels with renamed PuTTY tools, and focus on critical sectors in Russia. Attribution is uncertain but suggests a Chinese-speaking group based on embedded strings. No CVE or patch information is available, and no known exploits in the wild have been confirmed.

The campaign enables attackers to maintain persistent access and execute arbitrary commands on compromised systems within critical Russian sectors, potentially leading to espionage, data manipulation, or disruption of operations. The use of DLL sideloading and multiple modular components increases stealth and operational flexibility. The presence of log cleaning tools indicates efforts to evade detection and forensic analysis.

No official patch or remediation guidance is currently available for this threat. Organizations using ViPNet should monitor for indicators of compromise such as the presence of malicious wtsapi32.dll files in ViPNet directories and unusual SSH tunnels using renamed PuTTY utilities. Incident response should focus on detection and removal of the HelloNet malware components. Patch status is not yet confirmed — check vendor advisories for updates.