ViPNet Hijacked: How Hackers Target Russian Government Agencies

It’s a story that feels almost cliché – a trusted piece of government‑approved software turned into a backdoor. In this case the software is ViPNet, a Russian‑origin VPN and private networking suite that’s been certified for use across ministries, energy firms, transport operators and even universities.

According to Kaspersky’s latest analysis, a threat‑actor group the researchers have dubbed “HelloNet” has been quietly slipping a malicious DLL called wtsapi32.dll – nicknamed HelloInjector – into the ViPNet Update System directory. The trick is simple, almost embarrassingly so: when the legitimate updater itcsrvup64.exe starts up, Windows loads the DLL from the same folder, and the malicious code gets a free ride into the system.

Once inside, HelloInjector injects itself into svchost.exe, grabbing elevated privileges and establishing persistence. From there it drops a handful of companion modules, each with a very on‑the‑nose name: HelloProxy handles in‑memory proxying to command‑and‑control servers, HelloExecutor runs commands and does network reconnaissance, HelloCleaner wipes ViPNet log files, and HelloBackdoor – a Rust‑based implant – lets the attackers upload or download files at will.

The traffic isn’t hidden behind obscure ports either. The proxy talks on TCP 5003 and 5060, while the backdoor uses the ubiquitous HTTPS port 443. Security teams are being urged to keep an eye on those ports, especially on machines that have ViPNet installed.

Who’s behind it? Kaspersky’s researchers point to a few tantalising clues: a stray string referencing sina.com and a download mirror hosted by the University of Science and Technology of China. That’s enough for them to tentatively label the actors as a Chinese‑speaking APT, but they’re quick to note the attribution is low confidence – it could easily be a false flag.

What we do know for sure is that the campaign has been active since at least May 2026 and has already impacted a range of Russian entities. The exact method by which the malicious DLL landed in the update folder remains undisclosed, and no public indicators of compromise such as file hashes or IP addresses have been released.

For anyone running ViPNet, the practical steps are straightforward: monitor for the presence of wtsapi32.dll in the update directory, watch for unexpected DLL injection into svchost.exe, and flag any outbound traffic on the aforementioned ports. Until ViPNet’s vendor, InfoTeCS, confirms whether their update infrastructure was compromised, the onus is on defenders to treat their own installations as potentially hostile.

It’s an uncomfortable reminder that even software vetted for “government‑grade” security can become a conduit for espionage when attackers find a single overlooked loading path. vigilance, layered monitoring and a healthy dose of skepticism remain the best defenses.