Overview
A sophisticated threat campaign is leveraging the ViPNet Client — a widely deployed Russian private networking product — to silently compromise government agencies, energy firms, transport companies, and industrial organizations. Researchers at Kaspersky's GReAT team disclosed the operation, dubbed HelloNet, on July 16, 2026, with attacks active since at least May 2026.
The campaign exploits the auto-update mechanism of ViPNet's itcsrvup64.exe component through DLL sideloading, meaning the attackers need no network-level exploit against ViPNet — they need only to pre-position a malicious file on disk.
Attack Chain: DLL Sideloading via the Update Directory
| Stage | Detail |
|---|---|
| Entry point | Malicious wtsapi32.dll placed in C:\Program Files (x86)\InfoTeCS\VIPNet Update System |
| Trigger | Legitimate itcsrvup64.exe auto-loads the spoofed library on Windows startup |
| Injection | Library injects into svchost.exe for persistence and stealth |
| C2 | 5.39.253[.]206 on ports 443, 5003, 5060; renamed PuTTY binary for SSH tunneling |
This is not a remote code execution flaw in ViPNet's network protocol. The attacker must already have some level of access to place the DLL — making initial access the critical question the investigation has not yet resolved.
The "Hello" Malware Suite
The campaign deploys five modular components:
- HelloInjector — loader that executes the full suite
- HelloProxy — tunnels traffic and delivers additional payloads
- HelloExecutor — reconnaissance and command backdoor
- HelloCleaner — scrubs logs and removes forensic artifacts
- HelloBackdoor — Rust-based component; listens on port 443 using a specific activation string
The modular design allows operators to selectively deploy only what a given target requires, reducing the malware's footprint and detection surface.
Attribution: Low-Confidence China Link
Kaspersky assessed with low confidence that a Chinese-speaking APT is responsible, citing:
- A Sina portal string embedded in samples
- Rust package downloads originating from a University of Science and Technology of China mirror
Researchers explicitly noted the possibility of planted false flags. No formal APT designation has been issued.
This is not the first ViPNet-targeting campaign. A separate 2025 incident involved backdoored LZH archives disguised as legitimate ViPNet software updates, suggesting the product is an ongoing point of interest for adversaries targeting Russian organizations.
Affected Sectors
- Russian federal government agencies
- Energy sector
- Transportation companies
- Educational institutions
- Logistics providers
- Industrial enterprises
Detection and Remediation
InfoTeCS released patched versions of ViPNet Client and ViPNet Administrator on July 17, 2026 — the day after public disclosure. Organizations running ViPNet should patch immediately.
Detection signals:
- Kaspersky KEDR Expert: rule
vipnet_load_library_code_injection - NDR/KATA platform: Suricata rule targeting HelloBackdoor traffic
- YARA rules: Published by InfoTeCS alongside the patch
Network monitoring:
Monitor for unexpected outbound connections on ports 443, 5003, and 5060 from ViPNet service processes. The C2 IP 5.39.253[.]206 should be blocked and checked in firewall and proxy logs.
File system:
Audit the ViPNet update directory for unexpected DLLs, particularly wtsapi32.dll:
C:\Program Files (x86)\InfoTeCS\VIPNet Update System\
Broader Context
The HelloNet campaign illustrates a persistent adversarial interest in supply-chain-adjacent attacks — not attacking the software vendor directly, but exploiting the trust users place in legitimate update mechanisms and directories. For organizations in sectors ViPNet serves (government, critical infrastructure), the lesson is consistent: update directories and service accounts are high-value lateral movement paths that deserve explicit monitoring even when the vendor software itself is trusted.
Sources
- Securelist — HelloNet: A Threat via the ViPNet Update System
- BleepingComputer — Hackers abuse ViPNet software to target Russian govt agencies