Hackers hijack Russian security tool ViPNet to spy on government agencies

Key points

• Kaspersky says a campaign called HelloNet has been running since at least May 2025, abusing the update system of ViPNet, a widely used Russian security product.
• Victims include Russian organisations in government, energy, transport, education and logistics.
• The attackers plant a malicious file that loads more malware, including a backdoor written in Rust and a tool that wipes ViPNet's own logs.
• Kaspersky tentatively points to a Chinese-speaking hacking group but flags the evidence as weak and says a false flag is possible.
• ViPNet's maker, InfoTeCS, has not been accused of any breach of its own update servers.

A hacking group has been quietly turning a trusted Russian security product against the very organisations that rely on it.

The campaign, dubbed HelloNet, was detailed by researchers at Kaspersky and first reported by BleepingComputer. It has been running since at least May 2025.

The target is ViPNet, a suite of security tools made by Russian firm InfoTeCS. ViPNet handles VPN connections (which create private tunnels between offices), firewalls, certificates and secure messaging. It is certified by the Russian state for use in government systems, which makes it a prize for spies.

Victims so far span government agencies, energy companies, transport operators, schools and logistics firms.

How did the hackers get in?

Kaspersky does not know. The researchers were careful to say that ViPNet's own update servers do not appear to have been broken into.

What the attackers did was slip a booby-trapped file into the folder on each victim's computer where ViPNet stores its update components. The file is called wtsapi32.dll, and Kaspersky has nicknamed it HelloInjector.

Here is the trick. When a Windows computer starts a program, it looks for the small helper files that program needs, called DLLs. If a malicious DLL with the right name is sitting in the right folder, Windows will load it without asking. So when ViPNet's legitimate update process ran at startup, it obediently loaded the attackers' file instead.

That gave the hackers a foothold that survived reboots and ran with high privileges on the machine.

What does the malware actually do?

HelloInjector is only the first stage. It quietly pulls in a second piece of code, HelloProxy, which runs entirely in memory and phones home to a server controlled by the attackers.

From there the operators can drop in more tools as they need them. Kaspersky found several:

• HelloExecutor, a backdoor for running commands and mapping the victim's network.
• HelloCleaner, which deletes ViPNet's log files so investigators cannot see what happened.
• HelloBackdoor, written in the Rust programming language, which uploads and downloads files and runs commands.

The cleanup tool is telling. It suggests the operators expect their victims to eventually go looking, and they want the trail cold when they do.

Who is behind it?

Kaspersky tentatively attributes HelloNet to a Chinese-speaking advanced hacking group but stresses the evidence is thin. It rests on an unused string of text referencing the Chinese portal sina.com and a malware download hosted on a mirror run by the University of Science and Technology of China.

The researchers say they cannot rule out a false flag, meaning another group deliberately planting Chinese breadcrumbs to mislead investigators.

No ransom is involved. This looks like classic espionage: get in, stay quiet, steal information.

What should defenders do?

Kaspersky recommends that any organisation running ViPNet watch traffic on ports 5003 and 5060, which HelloProxy uses, and port 443, used by HelloBackdoor. Port 443 is normally used for ordinary encrypted web traffic, which is exactly why the attackers picked it. It hides in the noise.

Administrators should also check the ViPNet update directory for any wtsapi32.dll file that should not be there, and audit which accounts have permission to write to it.