Hackers misuse ViPNet software in attacks against Russian authorities

An advanced cyber campaign exploits the update mechanism in the Russian security platform ViPNet to attack Russian authorities and other important organizations. The campaign, which has been named HelloNet, has been active since at least May and uses a chain of malicious components to establish long-term access to compromised systems.

According to researchers at Kaspersky The attacks have hit organizations in the public sector, energy, transportation, education and logistics. The campaign shows how even trusted security software can be exploited as part of an advanced attack chain.

Attackers exploit ViPNet's update mechanism

ViPNet is a suite of information security products developed by the Russian company InfoTeCS. The platform includes VPN, network and client protection, firewall, certificate management, central administration, and secure messaging and file transfer.

The product is widely used in Russia and is certified for use in government agencies and other regulated businesses. Due to its widespread use in critical operations, ViPNet has long been an attractive target for cyberattackers. As early as April 2025, Kaspersky reported attacks where threat actors pretended to distribute fake ViPNet updates.

In the latest campaign, the attackers place a malicious DLL file, wtsapi32.dll, as Kaspersky names HelloInjector, in the local directory for ViPNet Update System. Then the file is loaded by the legitimate process itcsrvup64.exe at system startup through a technique called DLL sideloading.

DLL sideloading involves tricking a legitimate program into loading a malicious DLL file instead of the intended system file. Because the process that launches the file is trusted, attackers can often bypass traditional security checks.

HelloInjector then injects code into the Windows process svchost.exe, which gives the malicious code elevated privileges, persistence across reboots, and the ability to load additional malicious components.

Kaspersky has not described how the attackers gained initial access to the systems, but the company emphasizes that there are no signs that ViPNet's central update infrastructure has been compromised.

Modular malware gives attackers full control

Once HelloInjector is activated, the built-in payload is executed HelloProxy directly into memory. Contact is then established with the attackers' command and control server (C2), which delivers additional modules depending on the target being attacked.

Among the identified components are:

• HelloExecutor – a backdoor that can execute commands and conduct network reconnaissance.
• HelloCleaner – a tool that deletes ViPNet logs to hide attackers' activity.
• HelloBackdoor – a Rust-based backdoor that supports file transfer, remote control, and command execution.

The modular architecture allows attackers to gradually expand functionality after gaining a foothold in the compromised environment, providing greater flexibility while reducing the risk of detection compared to delivering all the malware in a single step.

Possible connection to Chinese-speaking APT group

Kaspersky preliminarily assesses that the campaign may be linked to an as yet unidentified Chinese-speaking APT group (Advanced Persistent Threat).

However, the researchers emphasize that the evidence is limited. The attribution is based primarily on an unused string of code that references the Chinese website. sina.com as well as a malware download mirror operated by University of Science and Technology of China.

Against this background, Kaspersky classifies the attribution as low confidence and does not rule out that the identified traces may have been intentionally planted as part of a false flag operation.

Recommendations for organizations

Kaspersky recommends that organizations using ViPNet closely monitor their environments for signs of compromise. Particular attention should be paid to network traffic through the following ports:

• 5003 – used by HelloProxy
• 5060 – used by HelloProxy
• 443 – used by HelloBackdoor

Organizations should also check for the presence of unexpected DLL files in ViPNet installation directories, analyze suspicious processes running under svchost.exe and monitor logs and network traffic for abnormal behavior.

Trusted security software is increasingly becoming a target

The HelloNet campaign illustrates a growing trend where cybercriminals and state-linked threat actors are targeting trusted security solutions rather than attempting to bypass them. By leveraging legitimate processes and update mechanisms, attackers can reduce the risk of detection while establishing a long-term foothold in mission-critical environments.

For organizations, this means that traditional perimeter protection is no longer sufficient. Continuous monitoring, integrity checks of critical system files, behavioral detection, and a Zero Trust approach are increasingly important to detect advanced threats. cyberattacks before they cause serious damage.