An advanced persistent threat (APT) group has been observed exploiting the update mechanism of the ViPNet private networking suite to target Russian government agencies and other organizations. The campaign, dubbed "HelloNet" by researchers, has been active since at least May, deploying a multi-stage malware payload that establishes persistence and acts as a loader for additional malicious modules.
ViPNet, developed by InfoTeCS, is a widely used suite of information security products in Russia, certified for use in government and other regulated environments. Its functionalities include VPN, endpoint protection, firewalls, and secure messaging. The product's prevalence in high-value organizations has made it a recurring target for threat actors, with previous incidents, such as an April 2025 campaign, involving attackers impersonating ViPNet updates.
In the current HelloNet campaign, attackers achieve initial persistence by placing a malicious file, identified as `wtsapi32.dll` (dubbed "HelloInjector"), within the local ViPNet Update System directory. This allows the legitimate `itcsrvup64.exe` process to sideload the malicious DLL at system startup. HelloInjector then injects its payload into the `svchost.exe` process, granting elevated privileges and ensuring persistence across reboots on Windows systems. The exact method of initial access to modify the ViPNet Update System directory has not been detailed, nor has there been any confirmation that ViPNet's update infrastructure itself was compromised.
Once active, HelloInjector runs an embedded payload, named "HelloProxy," in memory. HelloProxy then contacts a command-and-control (C2) server to retrieve additional modules. These modules include "HelloExecutor," a backdoor capable of executing commands and performing network reconnaissance, and "HelloCleaner," a tool designed to remove ViPNet log data to obscure malicious activities. Another identified implant, "HelloBackdoor," is Rust-based and supports file upload/download capabilities in addition to command execution.
Organizations across various sectors in Russia have been impacted by the HelloNet campaign, including government, energy, transport, education, and logistics.
While researchers have tentatively attributed the campaign to an unidentified Chinese-speaking APT group, they emphasize that the evidence is weak. This attribution is primarily based on an unused string referencing the Chinese website sina.com and a malware download mirror hosted by the University of Science and Technology of China. Due to the limited evidence, the attribution is considered low confidence, and the possibility of a false flag operation has not been ruled out.
Security experts recommend close monitoring of systems running ViPNet software, with particular attention to network traffic on ports 5003 and 5060, which are used by HelloProxy, and port 443, used by HelloBackdoor.
