News Date: 2026-07-19
A sophisticated cyber-espionage campaign is exploiting the trust placed in ViPNet, a Russian networking and information-security product suite used by government agencies and regulated organizations. The operation, named HelloNet by Kaspersky researchers, has reportedly been active since at least May 2026 and has reached targets in government, energy, transportation, education and logistics.
Malware Hidden Beside Legitimate Software
The attackers place a malicious dynamic-link library named wtsapi32.dll inside the local ViPNet Update System directory. When the legitimate ViPNet executable starts, Windows loads the malicious library through DLL side-loading because it is found in a trusted application path.
The initial loader, called HelloInjector, injects code into the Windows svchost.exe process. This gives subsequent malware elevated execution privileges and helps preserve access after the computer restarts. The campaign then launches HelloProxy in memory, allowing the compromised host to communicate with command-and-control infrastructure and receive additional modules.
Those modules include HelloExecutor, which runs commands and performs network reconnaissance, and HelloCleaner, which deletes ViPNet logs that might reveal the intrusion. A Rust-based implant called HelloBackdoor provides further command execution and file-transfer capabilities.
Researchers have not established how the attackers obtained the initial access needed to place the malicious library on targeted systems. They also have not concluded that InfoTeCS or the central ViPNet update infrastructure was directly compromised. That distinction matters because the current evidence points to local abuse of trusted software rather than a confirmed vendor-wide supply-chain breach.
Defensive Priorities
- Verify the integrity of files inside ViPNet installation and update directories.
- Alert on unexpected DLL creation or modification near signed executables.
- Review unusual traffic over ports 5003, 5060 and 443.
- Investigate suspicious injection into svchost.exe.
- Forward security software logs to protected, remote storage.
Kaspersky has tentatively linked the activity to a Chinese-speaking threat actor, but it rates that attribution with low confidence and has not ruled out deliberate misdirection.
I believe the wider lesson is that trusted security tools require the same application-control and integrity monitoring as any other privileged software. Products designed to protect communications often operate with extensive permissions, making their directories and processes valuable hiding places. Organizations should therefore monitor not only whether security software is running, but also what files it loads and how its behavior changes over time.