The ViPNet product suite, developed by the prominent Russian cybersecurity firm InfoTeCS, is an integrated family of security solutions that provides Virtual Private Network (VPN) capabilities, endpoint protection, network access control, and secure messaging. Because ViPNet is officially certified by Russian regulatory authorities, including the Federal Security Service (FSB) and the Federal Service for Technical and Export Control (FSTEC), it is ubiquitous within government-mandated environments and critical infrastructure sectors. This high level of trust and widespread deployment makes the software an attractive vector for advanced persistent threat (APT) groups seeking a centralized point of entry into otherwise hardened networks.
Mechanics of the HelloNet Campaign
The HelloNet campaign distinguishes itself through a precise execution of DLL sideloading, a technique where a legitimate, signed executable is tricked into loading a malicious library. In this specific instance, the attackers target the ViPNet Update System. According to technical analysis, the threat actors place a malicious file named wtsapi32.dll—internally dubbed "HelloInjector"—into the local directory of the ViPNet Update System. This directory typically houses the legitimate service executable itcsrvup64.exe.
When the system boots or the update service initializes, itcsrvup64.exe automatically loads the malicious wtsapi32.dll from its local folder rather than the legitimate system version. This initial stage, HelloInjector, serves as the primary loader. Once active, it injects its payload into the svchost.exe process, a critical Windows host process for services. By migrating to svchost.exe, the malware achieves two primary objectives: it gains elevated system privileges and ensures persistence, remaining active even after the user logs out or the system is rebooted.
While the exact method of initial access remains a subject of investigation, researchers at Kaspersky have noted that there is currently no evidence to suggest that InfoTeCS’s central update infrastructure was compromised. Instead, it appears the attackers gain prior access to the target systems—perhaps through phishing, credential theft, or the exploitation of other vulnerabilities—and then use the ViPNet directory as a staging ground for their specialized tools. This approach allows the malware to hide in plain sight, masquerading as a component of a trusted security suite.
The HelloNet Malware Arsenal
The HelloNet campaign employs a modular toolset, allowing the attackers to tailor their activities based on the specific requirements of the compromised environment. The primary payload delivered by HelloInjector is "HelloProxy," a sophisticated module that operates entirely in the system’s memory to avoid detection by traditional disk-scanning antivirus solutions. HelloProxy establishes a connection with a command-and-control (C2) server, functioning as both a communication bridge and a downloader for subsequent malicious components.
Once the connection is established, the attackers can deploy several specialized modules:
- HelloExecutor: This backdoor is the primary tool for interaction. It allows the threat actors to execute arbitrary commands on the infected host and conduct detailed network reconnaissance. Through HelloExecutor, the attackers can map the internal network, identify other high-value servers, and prepare for lateral movement.
- HelloCleaner: Recognizing the importance of stealth in long-term espionage, the attackers utilize HelloCleaner to sanitize the environment. This tool is specifically designed to identify and delete ViPNet log data. By removing records of the update service’s activities, the attackers effectively erase the digital breadcrumbs that might alert system administrators to the unauthorized file changes.
- HelloBackdoor: A more robust implant, HelloBackdoor is written in the Rust programming language. The use of Rust is a growing trend among APT groups due to its performance, memory safety features, and the relative difficulty it presents for reverse-engineers compared to more common languages like C++. This module supports comprehensive file management—including the uploading of additional tools and the exfiltration of sensitive data—as well as the execution of complex command sequences.
Targeting and Sector Analysis
The scope of the HelloNet campaign is broad, reflecting a strategic interest in the core pillars of the Russian state and economy. The primary sectors impacted include:
- Government Agencies: Infiltration of ministerial networks provides access to sensitive policy documents, internal communications, and personnel data.
- Energy and Transport: These sectors represent critical infrastructure. Access to these networks could potentially be leveraged for sabotage or to gain leverage in geopolitical negotiations.
- Logistics: Monitoring the movement of goods and resources provides intelligence on economic health and military supply chains.
- Education: Targeting universities and research institutions often serves a dual purpose: the theft of intellectual property and the use of academic networks—which are often less secure—as a "stepping stone" to more sensitive government targets.
Attribution and the "False Flag" Dilemma
Kaspersky researchers have tentatively linked the HelloNet campaign to an unidentified Chinese-speaking APT group. However, the cybersecurity community remains cautious, assigning this attribution "low confidence." The evidence supporting a Chinese origin is limited to a few specific indicators: an unused string within the code that references the Chinese portal sina.com and the discovery of a malware download mirror hosted by the University of Science and Technology of China (USTC).
While these clues point toward a Chinese-speaking actor, experts warn that they could be "false flags." In the world of high-stakes cyber espionage, threat actors often plant misleading evidence to redirect blame toward other nations. The presence of Chinese-language strings in a malware sample does not definitively prove the origin of the attack, as such elements can be easily spoofed by sophisticated actors from other regions. Given the current geopolitical climate, where Russia and China maintain a strategic partnership, the discovery of Chinese-led espionage against Russian state assets is a sensitive finding that requires rigorous verification.
Chronology of Escalating Threats
The HelloNet campaign is not the first time ViPNet has been leveraged by malicious actors. In April 2025, researchers identified a separate campaign where attackers distributed a malicious backdoor that mimicked a legitimate ViPNet update. In that instance, the malware was delivered via a fake installer, preying on users who were attempting to manually update their security software.
The transition from "impersonating" an update to "abusing" the actual update directory—as seen in the current HelloNet campaign—represents an escalation in sophistication. It suggests that the threat actors have moved from social engineering and external spoofing to a more direct, technical exploitation of the software’s local environment. This timeline indicates a persistent and evolving interest in ViPNet by various threat actors, likely due to its role as a "gatekeeper" for Russian sensitive data.
Broader Implications for Russian Cybersecurity
The HelloNet campaign underscores a fundamental vulnerability in the strategy of "sovereign technology." Russia has long pushed for the replacement of Western technology with domestic alternatives to reduce the risk of foreign backdoors. However, the concentration of security functions into a single, government-mandated platform like ViPNet creates a "single point of failure." If a threat actor can successfully subvert or hide within that platform, they gain access to the entire ecosystem of organizations that are legally required to use it.
Furthermore, the campaign highlights the challenges of securing the supply chain and local software environments. Even when the central vendor (InfoTeCS) remains uncompromised, the trust placed in their software by the operating system and the user can be exploited. This "living off the land" approach, where attackers use legitimate tools and directories to facilitate their operations, makes detection significantly more difficult for standard security operations centers (SOCs).
Defensive Recommendations and Mitigation
In response to these findings, cybersecurity firms are advising Russian organizations to implement rigorous monitoring of their ViPNet installations. Specific attention should be paid to network traffic passing through ports 5003 and 5060, which are utilized by the HelloProxy module, as well as port 443, used by HelloBackdoor for its C2 communications.
System administrators are also encouraged to:
- Perform integrity checks on the ViPNet installation directories, specifically looking for unauthorized versions of
wtsapi32.dll. - Monitor the behavior of the
itcsrvup64.exeprocess for any unusual child process creation or memory injection activities. - Implement advanced endpoint detection and response (EDR) solutions that can identify the behavioral patterns of DLL sideloading and memory-only payloads.
- Review and audit all ViPNet logs frequently, looking for gaps or unexplained deletions that might indicate the presence of "HelloCleaner."
As the HelloNet campaign continues to evolve, it serves as a stark reminder that no software, regardless of its certification or domestic origin, is immune to exploitation. The targeting of Russian government agencies through their own security tools represents a significant breach of trust in the digital infrastructure and necessitates a comprehensive re-evaluation of how domestic security suites are protected against sophisticated local exploitation.
