Hackers Abuse ViPNet Software to Target Russian Govt Agencies
Hackers are abusing the update mechanism for the ViPNet private networking product suite to target Russian organizations, including government agencies. The campaign, dubbed HelloNet, has been active since at least May and has impacted organizations in various sectors.
Intelligence analysis by Llama
Hackers are exploiting a vulnerability in the ViPNet update system to deploy a malicious payload that acts as a proxy and loader for additional malware. The campaign, HelloNet, has been active since May and has targeted organizations in the government, energy, transport, education, and logistics sectors.
Imagine you have a special kind of software that helps keep your computer safe from hackers. But what if someone found a way to trick the software into letting them in? That's what's happening with the ViPNet software, which is used by many Russian organizations. Hackers are exploiting a vulnerability in the software to deploy malware and steal sensitive information.
Analysis
A $60B Vote of Confidence in Russian Cybersecurity
The recent campaign, dubbed HelloNet, has been exploiting a vulnerability in the ViPNet update system to deploy a malicious payload that acts as a proxy and loader for additional malware. This has allowed hackers to target Russian organizations, including government agencies, with a high degree of success. The campaign has been active since at least May and has impacted organizations in various sectors, including government, energy, transport, education, and logistics.
The ViPNet software is a family of Russian information-security products developed by InfoTeCS, providing VPN, endpoint, and network access protection, firewall, certificate management, centralized administration, and secure messaging and file transfer. The tool is commonly used in Russia, where it is certified by the authorities for use in government and other regulated environments. Due to its market reach in Russia, especially among high-value organizations, it has been targeted often by hackers.
In April 2025, Kaspersky reported that threat actors impersonated a ViPNet update in attacks. In the latest campaign, attackers placed a malicious file (wtsapi32.dll, dubbed HelloInjector) inside the local ViPNet Update System directory to be sideloaded at system startup via the legitimate itcsrvup64.exe. This DLL is the first-stage loader that injects into the svchost.exe process, granting next-stage payloads elevated privileges on Windows and persistence across reboots.
Kaspersky does not describe exactly how the attackers gained initial access to perform this file change, nor do they claim that ViPNet's update infrastructure itself was compromised. The malware toolset includes HelloInjector, which runs its embedded payload, HelloProxy, in memory and contacts the command-and-control (C2) server to receive additional modules. One of these modules is HelloExecutor, a backdoor that can execute commands and conduct network reconnaissance on the host. A second one is HelloCleaner, a tool that removes ViPNet log data to hide the malicious activity. Another implant called HelloBackdoor is Rust-based and supports uploading and downloading files, as well as command execution.
Kaspersky has tentatively attributed the campaign to an unidentified Chinese-speaking advanced persistent threat (APT) group. However, the researchers stressed that the evidence is weak, relying primarily on an unused string referencing the Chinese website sina.com and a malware download mirror hosted by the University of Science and Technology of China. As a result, they assign the attribution low confidence and do not rule out the possibility of a false flag operation.
The cybersecurity firm recommends thorough monitoring of systems running ViPNet software, particularly traffic passing through ports 5003, 5060 (HelloProxy), and 443 (HelloBackdoor). This is crucial in preventing the spread of malware and minimizing the damage caused by the HelloNet campaign.
Key points
- Hackers are exploiting a vulnerability in the ViPNet update system to deploy a malicious payload that acts as a proxy and loader for additional malware.
- The campaign, dubbed HelloNet, has been active since at least May and has impacted organizations in various sectors, including government, energy, transport, education, and logistics.
- The ViPNet software is a family of Russian information-security products developed by InfoTeCS, providing VPN, endpoint, and network access protection, firewall, certificate management, centralized administration, and secure messaging and file transfer.
- Kaspersky has tentatively attributed the campaign to an unidentified Chinese-speaking advanced persistent threat (APT) group, but the evidence is weak and the attribution is low confidence.
If the Russian government and organizations take immediate action to address the vulnerability in the ViPNet software, they may be able to prevent further attacks and minimize the damage caused by the HelloNet campaign. Additionally, the international community may come together to share information and best practices for cybersecurity, leading to a more secure online environment for all.
If the vulnerability in the ViPNet software is not addressed promptly, the HelloNet campaign could continue to spread and cause significant damage to Russian organizations. Additionally, the lack of transparency and cooperation from the Chinese-speaking APT group could make it difficult to attribute the attack and hold them accountable.
