Kaspersky Links "HelloNet" Malware Campaign to Abuse of ViPNet Networking Software in Russia

An advanced threat actor has been exploiting the update mechanism of ViPNet, a widely used Russian networking and security product suite, to deploy a multi-component malware toolset against government agencies and other high-value organizations, according to researchers at Kaspersky.

The campaign, which Kaspersky has dubbed HelloNet, has been active since at least May and has affected organizations across government, energy, transport, education, and logistics sectors in Russia.

ViPNet is developed by InfoTeCS and provides a range of security functions including VPN, endpoint protection, firewall, certificate management, and secure messaging. The product is certified by Russian authorities for use in government and regulated environments, making it a frequent target for threat actors seeking access to sensitive networks.

In the HelloNet campaign, attackers placed a malicious file — a DLL named wtsapi32.dll and tracked by Kaspersky as HelloInjector — inside the local ViPNet Update System directory. The file is sideloaded at system startup through the legitimate itcsrvup64.exe process. From there, HelloInjector injects into svchost.exe, granting elevated privileges on Windows and establishing persistence across reboots.

Kaspersky did not identify how attackers gained initial access to place the file, and the researchers explicitly stated that ViPNet's update infrastructure itself was not found to be compromised.

Once active, HelloInjector executes its embedded payload — a component called HelloProxy — in memory, which then contacts a command-and-control server to receive additional modules.

Those modules form a layered toolset. HelloExecutor is a backdoor capable of running commands and conducting network reconnaissance. HelloCleaner removes ViPNet log data to obscure the intrusion. A fourth implant, HelloBackdoor, is written in Rust and supports file uploads and downloads as well as command execution.

Kaspersky has tentatively attributed the campaign to an unidentified Chinese-speaking advanced persistent threat group, but the firm stressed that the evidence is weak. The primary indicators are an unused string referencing the Chinese website sina.com and a malware download mirror hosted by the University of Science and Technology of China. As a result, Kaspersky assigned the attribution low confidence and said it could not rule out a false flag operation.

This is not the first time ViPNet has been used as an attack vector. In April 2025, Kaspersky reported a separate incident in which threat actors impersonated a ViPNet update to conduct attacks.

The firm is recommending that organizations running ViPNet software implement thorough monitoring of network traffic, specifically on ports 5003 and 5060, which HelloProxy uses, and port 443, used by HelloBackdoor.

The HelloNet campaign underscores how widely deployed, trusted software in regulated environments can become a conduit for targeted intrusions — particularly when that software's privileged access and update processes are not closely monitored at the endpoint level.