THREAT OPS › Threat News › HelloNet campaign: new malicious modules launched through the ViPNet update system
HelloNet campaign: new malicious modules launched through the ViPNet update system
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/07/16110058/hellonet3_vipnet_pingpongsuperman_red_digital_computerized_hydra_destroying_comp_aa0b5c86-fb99-48d0-8109-cd57849fabc8-990x400.jpg" width="990" /></p><p><a href="https://securelist.com/tr/hellonet-vipnet
MITRE ATT&CK techniques
- Create or Modify System ProcessT1543
- Local Data StagingT1074.001
- Malicious FileT1204.002
- Windows ServiceT1543.003
- SSHT1021.004
- System Service DiscoveryT1007
- System Information DiscoveryT1082
- Data from Local SystemT1005
- MasqueradingT1036
- Process InjectionT1055
- System Binary Proxy ExecutionT1218
- Protocol TunnelingT1572
- Modify RegistryT1112
- System Network Configuration DiscoveryT1016
- ProxyT1090
- Command and Scripting InterpreterT1059
- Indicator RemovalT1070
- File and Directory DiscoveryT1083
- System Network Connections DiscoveryT1049
- Process DiscoveryT1057
- System ServicesT1569
- Windows Command ShellT1059.003
- File DeletionT1070.004
- Remote System DiscoveryT1018
- Ingress Tool TransferT1105
- Service ExecutionT1569.002
- Data from Local SystemAML.T0037
- MasqueradingAML.T0074
- Process DiscoveryAML.T0089
Indicators of compromise
- 16c211c96735f2fae9361b89bd7a31bfmd5
- 1bfe2b9493128574907a8279256a8bccmd5
- f9eed2f0158dc98e7012fb809152209cmd5
- 6001829a128fe264b4403138700c11a8md5
- ee4ff46ddd8489e81447962f927bc3f6md5
- 41c938b3cd7e55d4077e34976929b140md5
- b103cd21280b4061f88b2bcc51394894md5
- 9f5606a0755bc633b9bd7db6d179c09emd5
- 0cfdffc56f0fa325d0c4d24780b46597md5
- https://lp.kaspersky.com/global/next/?page=enterprise&icid=gl_sl_next-lnk_sm-team_8f480787632de728url
- https://www.kaspersky.com/enterprise-security/endpoint-detection-response-edr?icid=gl_sl_post-kedr-expert_sm-team_29dc1130f3f612f2url
- https://tip.kaspersky.com/landscape/hunts/636118eb-a590-3092-1bde-dcc9c76eb9b8url
- https://tip.kaspersky.com/landscape/hunts/b664b561-5389-43a0-8807-e881fea4802furl
- https://www.kaspersky.com/enterprise-security/anti-targeted-attack-platform?icid=gl_sl_post-kata_sm-team_839dfa6f6cbc16e1url
- https://www.kaspersky.com/enterprise-security/managed-detection-and-response?icid=gl_sl_mdr-lnk_sm-team_195a10e9872df951url
- https://www.kaspersky.com/enterprise-security/unified-monitoring-and-analysis-platform?icid=gl_sl_siem-inpost-link_sm-team_c6da27b0f60ba483url
- https://opentip.kaspersky.com/16c211c96735f2fae9361b89bd7a31bf/results?icid=gl_sl_tr-post-opentip_sm-team_b2544b8d18560bfe&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/1bfe2b9493128574907a8279256a8bcc/results?icid=gl_sl_tr-post-opentip_sm-team_c7f7fa1bfba2becc&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/f9eed2f0158dc98e7012fb809152209c/results?icid=gl_sl_tr-post-opentip_sm-team_8338a0e97b9b5ef2&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/6001829a128fe264b4403138700c11a8/results?icid=gl_sl_tr-post-opentip_sm-team_d290dddf19c6f304&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/ee4ff46ddd8489e81447962f927bc3f6/results?icid=gl_sl_tr-post-opentip_sm-team_5180ebbc1df58c6c&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/41c938b3cd7e55d4077e34976929b140/results?icid=gl_sl_tr-post-opentip_sm-team_1fb10f73303fa060&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/b103cd21280b4061f88b2bcc51394894/results?icid=gl_sl_tr-post-opentip_sm-team_005ffcdb12addfc8&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/9f5606a0755bc633b9bd7db6d179c09e/results?icid=gl_sl_tr-post-opentip_sm-team_b186c06c072b3f5e&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/0cfdffc56f0fa325d0c4d24780b46597/results?icid=gl_sl_tr-post-opentip_sm-team_eec61412e8b0bad2&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/5.39.253.206/?tab=lookup&icid=gl_sl_tr-post-opentip_sm-team_797cc2ee49ae90ea&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/176.32.34.135/results?icid=gl_sl_tr-post-opentip_sm-team_1200abc11e7416c6&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- 8.8.8.8ipv4
- 5.39.253.206ipv4
- 145.0.0.0ipv4
- 176.32.34.135ipv4
- media.kasperskycontenthub.comdomain
- news.sina.comdomain
- sina.comdomain
- mirrors.ustc.edu.cndomain
- mail.rudomain
Original source: https://securelist.com/tr/hellonet-vipnet/120700/