Hackers hijack Russian security tool ViPNet to spy on government agencies

Key points

• Kaspersky says a campaign called HelloNet has been running since at least May 2025, abusing the update system of ViPNet, a widely used Russian security product.
• Victims include Russian organisations in government, energy, transport and logistics.
• The attackers plant a malicious file that loads further malware, including a backdoor written in Rust and a tool that wipes ViPNet's own logs.
• Kaspersky tentatively points to a Chinese-speaking hacking group but flags the evidence as weak and says a false flag is possible.
• ViPNet's maker, InfoTeCS, has not been accused of any breach of its own update servers.

A hacking group has been quietly turning a trusted Russian security product against the very organisations that rely on it.

The campaign, dubbed HelloNet, was detailed by researchers at Kaspersky and first reported by BleepingComputer. It's been running since at least May 2025. Kaspersky's earlier work on similar ViPNet-themed lures, which we covered on 19 July, makes this escalation harder to dismiss as opportunistic.

The target is ViPNet, a suite made by Russian firm InfoTeCS. It handles VPN connections (private tunnels between offices), firewalls, certificate management and secure messaging. Certified by the Russian state for government use, it's exactly the kind of tool a spy operation wants to weaponise.

Victims span government agencies, energy companies, transport operators and logistics firms.

How did the hackers get in?

Kaspersky doesn't know. The researchers were careful to say that ViPNet's own update servers don't appear to have been broken into.

What the attackers did was plant a booby-trapped file, called wtsapi32.dll and nicknamed HelloInjector, in the folder where ViPNet stores its update components. When Windows starts a program, it looks for small helper files called DLLs. If a malicious DLL with the right name sits in the right folder, Windows loads it without question. So when ViPNet's legitimate update process ran at startup, it loaded the attackers' file instead, via the legitimate itcsrvup64.exe.

That gave the hackers a foothold that survived reboots and ran with high privileges.

What does the malware actually do?

HelloInjector is only the first stage. It pulls in HelloProxy, which runs entirely in memory and phones home to the attackers' server. From there, operators drop in further tools as needed.

Kaspersky found three. HelloExecutor is a backdoor for running commands and mapping the victim's network. HelloCleaner deletes ViPNet's log files so investigators can't see what happened. HelloBackdoor, written in Rust, uploads and downloads files and executes commands.

The cleanup tool is telling. It suggests the operators expect their victims to eventually go looking, and they want the trail cold when they do. No ransom is involved. This is classic espionage: get in, stay quiet, steal.

Who is behind it?

Kaspersky tentatively attributes HelloNet to a Chinese-speaking advanced persistent threat group but stresses the confidence is low. The attribution rests on an unused text string referencing sina.com and a malware download hosted on a mirror run by the University of Science and Technology of China. The researchers can't rule out a false flag, meaning another group deliberately planting Chinese breadcrumbs to mislead investigators.

It's a pattern worth watching. Kaspersky's GoSerpent report from 17 July flagged the same attribution difficulty for a separate espionage campaign, underlining how routinely operators now muddy the forensic trail.

Should you worry?

If your organisation runs ViPNet, yes. Kaspersky recommends monitoring traffic on ports 5003 and 5060, used by HelloProxy, alongside port 443, the standard encrypted-web port that HelloBackdoor hides inside precisely because it blends with normal traffic.

Administrators should check the ViPNet update directory for any wtsapi32.dll file that shouldn't be there, and audit which accounts can write to it.