Key Takeaways
- A Chinese‑speaking APT group (low‑confidence attribution) is exploiting the legitimate update mechanism of ViPNet, a widely used Russian security suite, to infiltrate government and critical‑infrastructure organizations.
- The campaign, dubbed HelloNet, has been active since at least May 2025 and uses a sideloaded DLL (HelloInjector) to gain persistence and elevated privileges.
- HelloInjector launches an in‑memory proxy (HelloProxy) that contacts C2 servers on ports 5003 and 5060, downloads additional modules, and enables further malicious activity.
- Secondary payloads include HelloExecutor (command‑execution backdoor), HelloCleaner (log‑wiping tool), and HelloBackdoor (Rust‑based file‑transfer and command implant).
- The attackers have not been shown to compromise ViPNet’s update infrastructure itself; instead, they place a malicious file in the local update directory to be loaded by the legitimate updater.
- Defenders should monitor ViPNet‑related processes, block unauthorized DLL sideloading, and watch traffic on ports 5003, 5060, and 443 for signs of HelloNet activity.
ViPNet Overview and Its Strategic Value
ViPNet is a family of information‑security products developed by the Russian vendor InfoTeCS. It bundles VPN connectivity, endpoint protection, network‑access control, firewall capabilities, certificate management, centralized administration, and secure messaging/file transfer into a single suite. Because ViPNet is certified by Russian authorities for use in government agencies, defense contractors, energy firms, transportation operators, educational institutions, and logistics companies, it enjoys deep penetration across high‑value sectors. This widespread adoption makes ViPNet an attractive target for threat actors seeking a foothold in strategically important networks, as compromising the suite can provide privileged access to multiple downstream systems.
HelloNet Campaign Discovery
In May 2025, Kaspersky researchers identified a sustained intrusion campaign they named HelloNet, which abuse the update mechanism of ViPNet to deliver malware to Russian organizations. The campaign has affected entities across government, energy, transport, education, and logistics, indicating a broad scope that aligns with ViPNet’s typical customer base. Although the exact date of initial compromise remains unspecified, the persistence of the activity over several months suggests a well‑planned, low‑and‑slow operation designed to avoid immediate detection while establishing a resilient foothold.
Abuse of the ViPNet Update Mechanism
The attackers did not need to breach ViPNet’s central update servers; instead, they leveraged a classic DLL sideloading technique. By placing a malicious file named wtsapi32.dll (referred to as HelloInjector) inside the local ViPNet Update System directory, they ensured that the legitimate updater executable itcsrvup64.exe would load the malicious DLL at system startup. This method abuses the trust placed in the update process, allowing the malicious code to run with the same privileges as the updater—typically SYSTEM‑level—thereby gaining elevated access and persistence across reboots without raising obvious alarms.
HelloInjector: First‑Stage Loader
HelloInjector serves as the initial loader in the infection chain. Once executed, it injects its payload into the svchost.exe process, a common Windows host for system services, thereby camouflaging its activity within a legitimate process. This injection grants the malware the ability to execute subsequent stages with high privileges and to survive reboots, as svchost.exe is routinely started during boot. Kaspersky’s analysis notes that the exact vector used to initially write HelloInjector into the update directory remains undisclosed, leaving open possibilities such as credential theft, supply‑chain compromise, or insider assistance.
HelloProxy: In‑Memory C2 Proxy
From within svchost.exe, HelloInjector launches an in‑memory component dubbed HelloProxy. This module establishes outbound connections to the attackers’ command‑and‑control (C2) infrastructure, primarily using TCP ports 5003 and 5060. HelloProxy acts as a relay, receiving further instructions and additional malware modules from the C2 server while forwarding any collected data back to the threat actors. Because it resides purely in memory and does not write files to disk, HelloProxy evades many traditional antivirus scans that rely on file‑based signatures.
Secondary Payloads: HelloExecutor, HelloCleaner, and HelloBackdoor
HelloProxy’s C2 channel enables the download of several specialized implants:
- HelloExecutor functions as a versatile backdoor capable of executing arbitrary shell commands, conducting network reconnaissance (e.g., scanning internal subnets, enumerating shares), and potentially launching further payloads.
- HelloCleaner is a post‑exploitation tool designed to erase ViPNet logs and other artifacts that could reveal the intrusion, thereby hindering forensic analysis and extending the attackers’ dwell time.
- HelloBackdoor, written in the Rust programming language, provides robust file‑upload/download capabilities and additional command‑execution features. Its choice of Rust may reflect an attempt to leverage modern language security mitigations while complicating reverse‑engineering efforts for defenders.
Together, these modules give the attackers a flexible toolkit for persistence, privilege escalation, data exfiltration, and anti‑forensic measures.
Attribution Assessment and Confidence Level
Kaspersky researchers have tentatively linked HelloNet to an unidentified Chinese‑speaking APT group. The basis for this assessment includes an unused string referencing the Chinese website sina.com embedded in the malware and the presence of a malware download mirror hosted by the University of Science and Technology of China. However, the analysts explicitly label the evidence as weak, assigning low confidence to the attribution and acknowledging the possibility of a false‑flag operation intended to mislead investigators. This cautious stance underscores the difficulty of attributing cyber‑operations without clear, mutually exclusive indicators.
Indicators of Compromise and Defensive Recommendations
To detect HelloNet activity, security teams should monitor for:
- Execution of itcsrvup64.exe loading an unexpected wtsapi32.dll (HelloInjector) from the ViPNet Update System directory.
- Unusual outbound traffic to external IP addresses on TCP ports 5003 and 5060 (HelloProxy) and port 443 (HelloBackdoor).
- Creation of suspicious processes injected into svchost.exe or other legitimate services.
- Attempts to delete or modify ViPNet log files, indicative of HelloCleaner operation.
- Presence of Rust‑based binaries exhibiting network‑beaconing characteristics consistent with HelloBackdoor.
Mitigation steps include enforcing strict application control to prevent unauthorized DLL sideloading, employing behavior‑based detection that flags abnormal process injection, restricting outbound connections to known ViPNet update servers, and conducting regular integrity checks of the ViPNet update directory. Additionally, organizations should review privileged account usage and consider network segmentation to limit lateral movement once an initial foothold is gained.
Broader Implications for Supply‑Chain Trust
The HelloNet incident illustrates how attackers can subvert legitimate update mechanisms without necessarily compromising the vendor’s infrastructure. By exploiting the trust placed in signed updates and the predictable location of update components, threat actors achieve persistence and privilege escalation while staying beneath the radar of many signature‑based defenses. This tactic highlights the growing importance of runtime integrity monitoring, code‑signing enforcement, and zero‑trust principles that treat even trusted software components as potentially hostile until verified in context. For sectors reliant on nationally certified solutions like ViPNet, the case reinforces the need for continuous vigilance, layered defenses, and proactive threat‑hunting to counter supply‑chain‑adjacent attacks.