HelloNet Campaign Turns ViPNet Security Software into a Spy Tool Targeting Russian Government Networks
Since at least May 2025, attackers have been hiding malicious files inside the update folder of ViPNet, a Russian-state-certified security suite, giving them persistent, privileged access to government ministries, energy companies, and transport operators.
A sophisticated espionage campaign has been quietly weaponising one of Russia's most trusted security products against the organisations that depend on it.
Researchers at Kaspersky published findings on a campaign they call HelloNet, which has been active since at least May 2025. The target: ViPNet, a security suite built by Moscow-based firm InfoTeCS that handles VPN connections, firewalls, digital certificates, and secure messaging. Because Russian state regulators have certified ViPNet for use in government systems, it is installed at exactly the kinds of targets that intelligence services find most attractive.
Victims identified so far include organisations in Russian government, energy, transport, education, and logistics.
How the Attack Works
Kaspersky was careful to state that InfoTeCS's own update servers do not appear to have been compromised. The attacker's method was more subtle. Someone, by means not yet established, placed a malicious file named `wtsapi32.dll` inside the folder on each victim machine where ViPNet stores its update components.
The technique is called DLL side-loading, and it exploits a basic feature of how Windows launches programs. When a Windows application starts, it searches for the small helper libraries (DLLs) it needs. If a file with the correct name sits in the correct folder, Windows loads it, no questions asked. So when ViPNet's legitimate update process ran at startup, it picked up the attacker's file, which Kaspersky nicknamed HelloInjector, right alongside the genuine components.
The result: a foothold that survived every reboot and ran with the elevated privileges belonging to ViPNet itself.
A Multi-Stage Toolkit
HelloInjector is only the entry point. Once loaded, it pulls a second component called HelloProxy into memory, keeping it off the disk where antivirus tools might spot it. HelloProxy then calls back to attacker-controlled infrastructure.
From that beachhead, operators deploy additional tools as needed:
- HelloExecutor: a backdoor for running arbitrary commands and mapping the victim network.
- HelloBackdoor: written in the Rust programming language, capable of uploading and downloading files and executing remote commands.
- HelloCleaner: a purpose-built log-wiping tool that deletes ViPNet's own audit logs after each operator session.
The presence of HelloCleaner is significant. The operators anticipated forensic investigation and prepared for it in advance, a level of operational discipline more consistent with a state-linked group than an opportunistic criminal one. No ransom demand has appeared. This has the hallmarks of classic long-term espionage: enter quietly, collect intelligence, erase traces, repeat.
Attribution: Tentative and Contested
Kaspersky's analysts point, with stated caution, toward a Chinese-speaking advanced persistent threat group. The evidence is thin: an unused text string referencing the Chinese web portal sina.com, and a malware sample hosted on a mirror operated by the University of Science and Technology of China. The researchers openly acknowledge that another group could have planted these breadcrumbs deliberately. False-flag operations are a documented technique in nation-state tradecraft.
No definitive attribution has been made.
Which Controls Failed?
The HelloNet campaign exposes a failure mode that sits at the intersection of supply-chain trust and endpoint hardening. Organisations running ViPNet trusted the product's update directory implicitly, and their operating systems did the same. Nobody verified that the DLLs in that folder belonged there. This is a write-permission problem: if a threat actor can place a file in a privileged application's working directory, the game is largely over before a single alert fires.
According to the Verizon 2024 Data Breach Investigations Report, system intrusion patterns, which include malware deployment and exploitation of trusted software channels, accounted for 36 percent of all breaches analysed. Abusing a trusted application's update path is a textbook way to bypass perimeter controls because the traffic and process activity look entirely normal to defenders who are not specifically hunting for anomalies inside that directory.
The use of port 443 for HelloBackdoor's command-and-control traffic is equally deliberate. Encrypted HTTPS traffic on port 443 is almost universally allowed outbound, and its volume in any enterprise environment is enormous. Hiding attacker callbacks inside that stream is reliable precisely because most organisations lack the inspection depth to catch it.
What Defenders Must Do
The control gap here is not primarily a technical one, though technical fixes exist. It is an oversight problem: organisations assumed a certified, trusted security product was an inviolable clean zone. That assumption was wrong.
Kaspersky recommends watching for anomalous traffic on ports 5003 and 5060, which HelloProxy uses, and scrutinising outbound connections on port 443 for unexpected destinations. Administrators should audit the ViPNet update directory for any `wtsapi32.dll` file and check which accounts hold write permission to that path. Write access to privileged application directories should follow the principle of least privilege: if a process does not need it, revoke it.
File integrity monitoring on directories used by security tools is a control that NIST SP 800-53 addresses directly under the SI-7 (Software, Firmware, and Information Integrity) control family. Organisations that have not applied that control to their security software's own working directories have a blind spot that HelloNet exploits perfectly.
Employee awareness also matters here, even in what looks like a purely technical attack. Initial access to victim machines, the step that placed HelloInjector in the first place, remains unexplained. Phishing, credential theft, and social engineering are common precursors to exactly this kind of file-drop. Security-awareness training that teaches staff to recognise and report suspicious activity can interrupt the initial access phase before a DLL ever lands on disk.
Recommended Immediate Actions
- Audit write permissions on all directories used by ViPNet and other certified security products.
- Deploy file integrity monitoring on security-software directories and alert on any unexpected DLL additions.
- Review outbound traffic rules: destination filtering on port 443, not just protocol allowance, is essential.
- Search endpoint logs for `wtsapi32.dll` in ViPNet paths that were not placed there by InfoTeCS installers.
- Check for log gaps in ViPNet audit data that could indicate HelloCleaner activity.
The Kaspersky advisory includes hashes and network indicators that administrators can load into endpoint detection and SIEM platforms immediately.
How this attack could have been disrupted earlier
- Apply file integrity monitoring to every directory used by certified security software, not just operating system paths, so unexpected DLL drops trigger an immediate alert.
- Enforce least-privilege write permissions on application directories: if a service account does not need to write to a folder, remove that permission before attackers exploit it.
- Train staff to recognise and report credential-theft attempts and suspicious access requests, since initial access to victim machines likely required a human-facing step before any malware was placed.
Train2Secure's security-awareness programmes help your team recognise the human-layer moves that precede technical attacks like HelloNet, before a single malicious file lands on disk.
Start free, no card requiredSources & further reading
Frequently asked questions
Were InfoTeCS's update servers hacked to deliver the HelloNet malware?
No. Kaspersky explicitly stated that InfoTeCS's own update infrastructure does not appear to have been breached. The attackers placed the malicious DLL directly on each victim machine through an access method that has not yet been identified.
What is DLL side-loading and why is it so effective?
DLL side-loading exploits the way Windows searches for helper libraries when launching an application. If an attacker places a malicious file with the correct name in the application's working directory, Windows loads it automatically. Because the host process is legitimate and trusted, many security tools do not flag the activity.
How can administrators detect HelloNet activity on their networks?
Kaspersky recommends monitoring for traffic on ports 5003 and 5060 (used by HelloProxy) and unusual outbound connections on port 443 (used by HelloBackdoor). Administrators should also audit ViPNet update directories for any unexpected wtsapi32.dll file and check for gaps in ViPNet's own log files, which HelloCleaner deletes to cover tracks.
Who is responsible for the HelloNet campaign?
Kaspersky has tentatively pointed toward a Chinese-speaking threat group based on limited artefacts, including a reference to sina.com and a hosting mirror associated with a Chinese university. The researchers caution that the evidence is weak and a false-flag operation by a third party cannot be ruled out.
