Today’s stories share a common thread: attackers reaching for infrastructure defenders trust by default — a certified VPN suite’s own update mechanism, the Windows logon screen, a support-ticketing platform, cloud file storage — rather than a novel exploit. A state-linked crew rides a legitimate update channel into Russian government networks, a rootkit older than most junior analysts’ careers turns up on a fresh host, a Big Four firm’s helpdesk platform leaks client tax data, and a ransomware crew gets its encryption blocked but walks away with stolen files anyway. Here’s what changed since yesterday’s digest.
Espionage watch: HelloNet campaign hijacks ViPNet’s own update mechanism to backdoor Russian government networks
Kaspersky’s GReAT team disclosed HelloNet, a previously undocumented campaign active since at least May that abuses the update system of ViPNet — a Russian-developed, government-certified suite for VPN, endpoint protection, and secure messaging widely deployed across regulated Russian organizations — to deliver malware disguised as a legitimate software update. Once installed, the infection chain runs through several purpose-built modules: HelloCleaner scrubs ViPNet’s own log files to hide attacker activity from the security product meant to be watching for it, HelloExecutor serves as a reconnaissance backdoor for mapping the victim network, and HelloBackdoor — written in Rust — sits on port 443 and stays dormant until it receives a specific activation string (half of the MD5 hash of the text “hello\n”) before accepting commands. Targets span government, energy, transport, education, and logistics organizations. Kaspersky tentatively attributes the campaign to a Chinese-speaking APT group, but rates the confidence low, based on a stray reference to sina.com and a malware mirror hosted at a University of Science and Technology of China domain. BleepingComputer · Securelist
The attackers didn’t need to break ViPNet — they needed victims to trust its update channel, and a security product actively erasing its own logs is a detail worth internalizing even outside Russia: any endpoint agent, VPN client, or “trusted” software update path in your environment is a plausible delivery mechanism, not just a defense. Verify update signing and integrity checks on your own security tooling, and if any of it writes local activity logs, make sure those logs also ship somewhere the endpoint itself can’t quietly wipe.
Malware watch: 13-year-old Daxin rootkit resurfaces in Taiwan alongside a pre-login SYSTEM backdoor
Symantec and Broadcom’s Carbon Black Threat Hunter Team found Daxin — the kernel-mode rootkit (“srt64.sys”) first documented in March 2022 and linked to China-nexus espionage against governments and critical infrastructure since 2013 — still active, this time on a compromised Taiwanese manufacturer’s network. Daxin hijacks legitimate existing TCP connections to blend its encrypted C2 traffic into normal network activity rather than opening new connections that stand out. Alongside it, researchers found a previously unreported companion, Stupig: a DLL backdoor that persists by registering itself as a Windows keyboard-layout provider, which causes win32k.sys to load it directly into winlogon.exe at system startup. From then on, it watches the Windows logon screen for any username beginning with the string “stupig” — anything typed after that prefix executes as a SYSTEM-privileged command, and if nothing follows, it just spawns a SYSTEM command prompt at the login screen itself, no credentials required. Both artifacts carry a 2013 compile timestamp, but the compromised host didn’t start reporting telemetry until May 12, 2026. Researchers found no shared code between Daxin and Stupig, but their co-deployment and matching build era point to the same operator. The Hacker News · Security Affairs
Stupig’s trick works specifically because almost nobody monitors what gets typed into the Windows username field before a session even starts — it’s a blind spot by design, not an oversight. If your endpoint telemetry doesn’t cover pre-authentication logon-screen activity or unexpected keyboard-layout-provider DLLs loading into winlogon.exe, this is the kind of persistence mechanism that would sail through undetected for years, exactly as it apparently just did.
Breach watch: EY confirms client tax records exposed after a third-party IT support platform hack
Ernst & Young disclosed that an unauthorized party accessed a third-party IT service management platform its own support staff use to help EY teams working on client tax matters — and that the support tickets submitted through that platform routinely include attached documents containing client tax information. The attacker had access from March 28 to April 12, 2026, and downloaded a number of documents before EY identified the anomalous activity on April 23. EY filed formal breach notification with the California Attorney General’s office on July 15 and has begun notifying affected individuals directly, offering 24 months of identity monitoring and restoration through Experian. No extortion or ransomware group has claimed responsibility, and EY hasn’t disclosed how many people are affected or named the compromised third-party provider. BleepingComputer · Security Affairs
A helpdesk or ITSM platform rarely shows up on a data-classification inventory, but a support ticket with an attached tax return is just as sensitive as anything in a primary system of record — and it usually gets a fraction of the access controls and monitoring. If your organization routes sensitive attachments through a support-ticketing tool (yours or a vendor’s), it’s worth confirming that platform is actually in scope for your DLP and access-review process, not assumed to be low-risk because it’s “just IT support.”
Ransomware watch: Ecopetrol’s controls block encryption, but the attacker still walks away with data from 3,300 accounts
Colombian state energy giant Ecopetrol disclosed that an external actor gained unauthorized access to its cloud file-storage environment, compromising roughly 3,300 accounts spanning about 15 entities across the Ecopetrol Group, including the parent company. The intruder attempted to deploy ransomware and encrypt files, but Ecopetrol says its security controls blocked the encryption before it could take hold. The attacker pivoted to straight extortion instead, threatening to publish the data it had already exfiltrated before the block kicked in. Ecopetrol reports no critical disruption to operations or production capacity, has revoked the attacker’s access, blocked further downloads, notified Colombian authorities, and increased monitoring across its technology infrastructure. No stolen data had been published as of the disclosure. Cybernews
“We blocked the ransomware” is good news, but it’s not the same as “we stopped the incident” — modern ransomware operators exfiltrate first and encrypt second specifically so a blocked encryption stage still leaves them with leverage. If your incident response playbook treats a blocked-encryption event as a near-miss rather than a full breach requiring the same data-loss investigation as a successful one, this is a good week to revisit that assumption.
Final thought
None of today’s four stories needed a novel exploit — a certified VPN’s trusted update path, a keyboard-layout registry trick as old as winlogon.exe itself, a support ticket nobody thought to classify, and pre-encryption exfiltration that outran a well-timed block. The common failure mode is treating “trusted” and “monitored” as the same thing. If you want a second opinion on whether your logging would actually catch a security tool wiping its own logs, an unusual keyboard-layout provider loading into winlogon.exe, sensitive attachments moving through a support platform, or exfiltration that happens before a ransomware block fires, see our guide to supply chain attacks against software companies or book a discovery call.