Kaspersky Details HelloNet Campaign Abusing ViPNet Updates in Russia

Kaspersky says it has uncovered a previously unknown campaign, internally named HelloNet, that hides inside the update system of ViPNet, a network security suite widely deployed across Russian government and industrial networks. In a report published July 16, 2026, researchers Konstantin Isakov, Georgy Kucherin, and Anton Kargin said the activity has been running since at least May 2026 and was still active at the time of publication. BleepingComputer covered the findings for a broader security audience on July 19.

ViPNet is built by the Russian vendor InfoTeCS and bundles VPN, endpoint and network access protection, a firewall, certificate management, centralized administration, and secure messaging and file transfer into one suite. It carries Russian government certification, which puts it on machines inside exactly the kind of organizations advanced attackers want access to. Kaspersky says this is not the first time ViPNet has been used as an attack surface: the firm reported a related campaign last year involving a backdoor built to look like a ViPNet update, which BleepingComputer dates to April 2025.

A Legitimate Update Folder Becomes the Entry Point

On infected machines, Kaspersky found a malicious file named wtsapi32.dll sitting inside C:\Program Files (x86)\InfoTeCS\VIPNet Update System, the folder used by ViPNet’s own update component. That placement matters: itcsrvup64.exe, a legitimate executable in the same folder, runs automatically at every Windows startup and loads DLLs from that directory without verifying them first. Placing a malicious file with the right name in the right folder is enough to get it loaded automatically, a technique known as DLL sideloading. Kaspersky’s report does not describe how the attackers first gained the access needed to place the file, and BleepingComputer notes that Kaspersky stops short of claiming InfoTeCS’s own update infrastructure was compromised. In other words, this looks like abuse of a local trust relationship on an already-touched machine, not a breach at the source.

The planted DLL, which Kaspersky calls HelloInjector, injects its code into the Windows svchost.exe process. According to BleepingComputer’s report, that step gives the attackers’ next-stage tools higher privileges on the machine and lets them survive a reboot. HelloInjector’s job is to load HelloProxy, a component that works as both a hidden network proxy and a launcher for whatever payload the command-and-control server sends next. HelloProxy listens on local ports 5003 and 5060 and authenticates its command server with a short handshake, sending the two-byte value 0x0502 and expecting a reply containing the string ASDFASFSAFASDF before it acts on incoming instructions. Kaspersky also found that the attackers used a renamed copy of the legitimate PuTTY utility to open an SSH tunnel back through infrastructure at 5.39.253[.]206, a second channel into the network alongside HelloProxy.

A Toolkit Built for Persistence and Cleanup

BleepingComputer’s reporting adds detail on two further modules in the kit: HelloExecutor, which runs commands and performs reconnaissance on the infected host, and HelloCleaner, which deletes ViPNet’s own log files to erase traces of the intrusion. Kaspersky separately disclosed a Rust-based implant, HelloBackdoor, found on at least one compromised system. It listens on port 443 and stays silent until it receives a specific authentication string, half of an MD5 hash, after which it can upload, download, and execute files.

Who Is Affected, and a Cautious Attribution

Kaspersky said it observed attempted infections at large Russian organizations spanning government, energy, transport, education, and logistics, as well as industry more broadly. Kaspersky links the campaign to an unknown Chinese-speaking APT group, but is careful to flag that its confidence in that call is low. The evidence is thin: one sample of the wtsapi32.dll file contained an unused, leftover HTTP request string referencing the domain news.sina.com, and the Rust code in the toolkit was compiled using packages pulled from mirrors.ustc.edu.cn, a mirror run by the University of Science and Technology of China. Kaspersky’s own assessment is that these artifacts most likely reflect the developers’ ordinary tooling choices rather than a deliberate signal, and the firm explicitly did not rule out a false flag designed to misdirect attribution.

What Kaspersky Recommends

Because ViPNet has now been abused in more than one campaign, Kaspersky is telling organizations that run it to pay particular attention to those workstations, including monitoring network traffic on the ports named in its report (5003, 5060, and 443) for the handshake and beaconing behavior described above. The firm frames detection here as a multi-layer problem: sideloaded DLLs and disguised proxy traffic are easy to miss with a single signature and much easier to catch when endpoint and network telemetry are correlated together. For defenders outside Russia, the broader lesson holds too: an update mechanism does not need to be breached at the source to become a liability, since a single writable local folder loaded by a trusted, auto-launching executable can be enough.

Sources: Kaspersky Securelist, BleepingComputer.