Adversary Intelligence — 2026-07-19

Hackers Exploit ViPNet Secure Communications Software to Infiltrate Russian Government Agencies

BLUFExploitation of ViPNet's trusted update mechanism as an intrusion vector into Russian government networks will likely yield additional disclosed victims over the next month, though attribution to a Chinese-speaking APT remains unanchored.

Kaspersky's Securelist reported an active campaign, dubbed HelloNet, that has infiltrated large Russian organizations across government, energy, transport, education, logistics, and industry sectors since at least May 1. Researchers found attackers planting a malicious library, wtsapi32.dll, in the ViPNet update system directory, where it loads via DLL sideloading through the legitimate itcsrvup64.exe process at startup 1. The loader, HelloInjector, deploys a hidden proxy and downloader called HelloProxy, which in turn delivered a reconnaissance backdoor (HelloExecutor), a log-cleaning tool (HelloCleaner), and a Rust-based file-transfer backdoor (HelloBackdoor) that listens on port 443 12. Kaspersky assessed with low confidence that the operation is linked to an unidentified Chinese-speaking APT group, citing an unused code string referencing a Chinese news portal and Rust package downloads from a Chinese university mirror, while cautioning the evidence could reflect a false-flag attempt 1. On one compromised network, attackers used a renamed PuTTY binary to establish an SSH tunnel to a command server at 5.39.253[.]206 13.

Analysis
HelloNet's use of legitimate DLL sideloading inside ViPNet's own update mechanism turns a trusted secure-networking product into the intrusion vector for sensitive Russian government, energy, and transport networks, and defenders relying on ViPNet's signed processes as implicitly trustworthy will miss the compromise. Kaspersky's low-confidence linkage to a Chinese-speaking APT rests on unused strings, evidence too thin to anchor targeting or intent judgments. Given the campaign's demonstrated persistence since May and its modular backdoor architecture built for follow-on tasking, it is likely additional victim organizations beyond those already identified will be disclosed over the next month. Confidence in that judgment is low, reflecting single-source technical reporting with no independent telemetry corroborating scope.
4 sources
  1. HelloNet campaign: a threat via the ViPNet update system - Kaspersky Securelist
  2. Hackers Exploit ViPNet Software to Target Russian Government Agencies - News4Hackers
  3. Российские компании атакуют через механизм обновлений ViPNet - Xakep.ru
  4. Sophisticated Backdoor Attack Targets ViPNet Networks - SecurityOnline

View in full brief →

UNCLASSIFIED // OPEN SOURCE