Since at least May 2025, the HelloNet campaign has been active, abusing the ViPNet update abuse vector to compromise Russian organisations. That’s the most surprising twist in a landscape already riddled with supply‑chain attacks. The campaign has already hit government agencies, energy firms, transport operators, universities, and logistics companies, according to Kaspersky researchers. It didn’t stop at a single sector. The attackers are using a malicious DLL that rides on a legitimate ViPNet updater, letting them slip past standard defenses.
Key Takeaways
- Hackers place a malicious HelloInjector DLL in the ViPNet Update System directory.
- The loader injects into
svchost.exe, granting elevated privileges and persistence. - Payloads communicate via ports 5003, 5060, and 443 for different modules.
- Kaspersky attributes the campaign to a low‑confidence Chinese‑speaking APT, but the evidence is thin.
- Defenders should monitor ViPNet traffic and clean log data to hide the intrusion.
ViPNet Update Abuse: How HelloNet Hijacks Russian Networks
ViPNet is a family of Russian information‑security products developed by InfoTeCS, offering VPN, endpoint protection, firewall, certificate management, and secure messaging. It’s certified by Russian authorities, so it’s a go‑to solution for government and regulated bodies. That’s why it’s such a juicy target for threat actors. In April 2025, Kaspersky reported that attackers had already impersonated a ViPNet update in earlier attacks. The latest campaign builds on that playbook, dropping a malicious file named HelloInjector into the local ViPNet Update System folder.
The update mechanism itself is designed for smooth rollout across large, distributed environments. It runs with system‑level privileges, which means any component it loads inherits those rights. Attackers exploit this trust relationship by planting a DLL that looks legitimate at a glance. Once the host boots, the updater doesn’t question the file’s origin; it simply loads it. That design choice, while convenient for administrators, creates a narrow window for abuse. The malicious DLL therefore gains a foothold before any security software can intervene.
What is ViPNet?
ViPNet provides centralized administration and secure file transfer, which many large Russian organisations rely on for daily operations. Because the software is pre‑approved for use in high‑value environments, it enjoys deep network penetration. That deep reach also means compromising ViPNet can give attackers a foothold across multiple critical sectors. The product’s update mechanism, itcsrvup64.exe, loads DLLs from its directory at system startup, a behaviour that the attackers exploit.
HelloNet Payload Chain: From HelloInjector to HelloBackdoor
The malicious HelloInjector DLL is the first‑stage loader. It injects into the Windows svchost.exe process, which elevates its privileges and ensures the malware survives reboots. That’s a classic persistence technique. Once inside memory, HelloInjector runs an embedded payload called HelloProxy, which reaches out to a command‑and‑control (C2) server to fetch additional modules.
First‑stage Loader: HelloInjector
When Windows boots, itcsrvup64.exe automatically loads any DLLs found in its directory. By placing HelloInjector there, the attackers piggyback on a trusted binary. The DLL then injects into svchost.exe, granting the next stage elevated rights. That’s how the attackers achieve persistence without raising immediate alarms.
From HelloProxy, the attackers can download modules like HelloExecutor, a backdoor that runs commands and performs network reconnaissance, and HelloCleaner, which wipes ViPNet log files to hide evidence. Another module, HelloBackdoor, is Rust‑based and supports file upload/download and command execution. Those capabilities give the threat actor a full remote‑access suite inside the compromised host.
Each module talks on a distinct port. HelloProxy prefers port 5003 for its initial handshake, while port 5060 is used for voice‑over‑IP style tunneling that can blend with legitimate traffic. The final backdoor uses port 443, the ubiquitous HTTPS channel, to evade deep‑packet inspection. By spreading communication across multiple ports, the campaign makes pattern‑based detection harder.
Attribution and the Chinese‑Speaking APT Theory
Kaspersky has tentatively linked the campaign to an unidentified Chinese‑speaking advanced persistent threat (APT) group. The evidence is weak: a stray string referencing the Chinese site sina.com and a malware download mirror hosted by the University of Science and Technology of China. That’s why Kaspersky assigns a low confidence level to the attribution and warns that it could be a false‑flag operation.
Because the attribution hinges on a single string and a foreign mirror, we can’t rule out that the attackers deliberately planted those clues. It’s a reminder that attribution in cyber‑espionage is often murky, especially when actors use misdirection. The lack of a clear, verifiable link to a known group means defenders should focus on the tactics, techniques, and procedures (TTPs) rather than the name of the adversary.
Defensive Recommendations: Monitoring Ports and Logs
Kaspersky advises organisations running ViPNet to monitor traffic on ports 5003 and 5060, which HelloProxy uses, as well as 443, the port for HelloBackdoor. That’s a concrete step you can take today. checking the integrity of the ViPNet Update System directory and ensuring only signed DLLs reside there can stop the initial injection.
- Audit the ViPNet Update folder for unexpected files like
wtsapi32.dll. - Set up alerts for processes spawning
svchost.exewith injected DLLs. - Enable logging of network traffic on ports 5003, 5060, and 443.
- Regularly clean ViPNet logs to detect anomalies early.
We’ve seen that many organisations log only a fraction of successful attacks. Security teams usually log 54% of successful incidents and alert on just 14%. That gap lets campaigns like HelloNet slip by unnoticed. Deploying breach‑and‑attack simulation tools can help validate your detection rules against this specific payload chain.
Operational Impact Scenarios
Consider a mid‑size energy firm that relies on ViPNet for secure file exchange between remote substations. An operator notices a new DLL named wtsapi32.dll sitting in the update folder. The file’s timestamp is recent, but the hash does not match the vendor‑published version. If the team immediately isolates the host, they can prevent the injection from ever reaching svchost.exe. Without that quick response, the attacker would gain persistence and could later use HelloExecutor to enumerate internal network maps, increasing the risk of a broader outage.
In a university setting, a research server runs ViPNet to protect sensitive data sets. An automated integrity check flags a mismatched signature on a DLL. The security team, following the recommended alerting workflow, triggers a forensic capture. The capture reveals that HelloProxy has already opened a connection on port 5003 to an external address. By cutting the network path and removing the malicious file, the institution averts data exfiltration that could have compromised ongoing projects.
For a logistics company, the update mechanism is scheduled to run nightly. A routine audit discovers that the update folder now contains an unfamiliar.dll file. The audit trail shows the file was written by the service account used for updates, which has write permissions across the entire domain. The company decides to enforce a stricter least‑privilege model, limiting the service account to the update directory only. This change blocks the attacker’s ability to drop HelloInjector in the future, reducing the attack surface dramatically.
These scenarios illustrate how a seemingly innocuous change—an extra DLL—can cascade into a full‑blown intrusion if left unchecked. The key is early detection and rapid containment.
What This Means For You
If you’re a developer or security engineer maintaining a ViPNet deployment, you need to treat the update mechanism as a potential attack surface. That means verifying code signatures for every DLL in the update folder and restricting write permissions to trusted service accounts only. You should also consider network segmentation to limit lateral movement if an endpoint is compromised.
For founders and tech leaders, the incident underscores the risk of relying on a single, vendor‑approved security stack for critical infrastructure. Diversifying security controls and incorporating independent integrity checks can reduce the blast radius of a supply‑chain compromise. Remember, the attackers didn’t need to break the update server itself; they simply dropped a file locally, which is a much easier foothold to gain.
The broader takeaway is that even software vetted by national authorities can be weaponised at the update level. That’s why continuous monitoring, strict change‑management, and rapid incident response are non‑negotiable for any organisation handling sensitive data.
Key Questions Remaining
- Will the HelloNet actors evolve their payloads to target other update utilities beyond ViPNet?
- How effective are existing endpoint detection platforms at spotting DLL injection into
svchost.exewhen the payload uses common system processes? - What steps can organisations take to harden the update chain without disrupting the operational convenience that ViPNet provides?
Answers to these questions will shape the next wave of defensive tooling. Until then, vigilance remains the best safeguard.
Sources: BleepingComputer, Kaspersky
