Tag
high
advisory
HelloNet Campaign Uses ViPNet Update System for Malicious Module Delivery
3 rules 11 TTPs 1 IOCAn unknown sophisticated threat actor is leveraging DLL sideloading within the ViPNet update system to deploy a multi-stage malware suite, including HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, and HelloBackdoor, to establish persistence, exfiltrate data, and maintain covert access to large Russian organizations in government, energy, and other critical sectors.
ViPNet Update System
apt
dll-sideloading
persistence
proxy
c2
reconnaissance
data-exfiltration
russia
+1
3r
11t
1i
critical
threat
Targeting and Compromise of French Entities Using the Turla Intrusion Set
The Turla intrusion set, operated by the 16th Centre of the Federal Security Service (FSB) of Russia, has been targeting French entities and other strategic organizations globally since at least 2004 for intelligence-gathering purposes, with victims in France including ministries and entities within the diplomatic, defence, justice, and technology sectors.
Turla
+4
nation-state
espionage
APT
russia
france