Kaspersky researchers have uncovered a campaign, dubbed HelloNet, that abuses the update mechanism of ViPNet, a Russian information-security product suite, to compromise government and critical infrastructure organizations. The activity has been ongoing since at least May and has hit targets across the government, energy, transport, education, and logistics sectors.

ViPNet, developed by InfoTeCS, is a widely deployed family of products offering VPN, endpoint protection, firewall, certificate management, centralized administration, and secure messaging. It carries official certification for use in Russian government and regulated environments, making it a recurring target for attackers. Kaspersky previously reported a similar ViPNet update impersonation attack in April 2025.

How the attack works

In this latest campaign, attackers planted a malicious file named wtsapi32.dll, tracked as HelloInjector, inside the local ViPNet Update System directory. The file is sideloaded at startup by the legitimate itcsrvup64.exe process. Kaspersky did not detail how the attackers achieved this initial file placement and did not claim that ViPNet’s own update infrastructure was breached.

HelloInjector acts as a first-stage loader, injecting code into svchost.exe to secure elevated privileges and persistence across reboots. It then runs an embedded payload called HelloProxy in memory, which contacts a command-and-control server to pull down additional modules.

Modular toolset

  • HelloExecutor: a backdoor capable of running commands and performing network reconnaissance
  • HelloCleaner: a utility that erases ViPNet log data to conceal malicious activity
  • HelloBackdoor: a Rust-based implant supporting file upload/download and command execution

Attribution and detection

Kaspersky has tentatively linked HelloNet to an unidentified Chinese-speaking APT group, but stressed the attribution is low-confidence. The evidence rests mainly on an unused string referencing a Chinese website and a malware download mirror hosted at a Chinese university, leaving open the possibility of a false flag operation.

Kaspersky recommends organizations running ViPNet software closely monitor network traffic, particularly on ports 5003 and 5060, used by HelloProxy, and port 443, used by HelloBackdoor, to detect signs of compromise.