Kaspersky details HelloNet abuse of ViPNet updater
Kaspersky says an unknown APT — low-confidence Chinese ties — has abused the InfoTeCS ViPNet update client to plant Russian orgs since May.
Dave "Kilobaud" Ferris Kaspersky’s Securelist team published research on Sunday describing a campaign it calls HelloNet — an intrusion set that has been abusing the update mechanism of ViPNet, the InfoTeCS-made Russian VPN and secure-networking suite certified for government and regulated environments, to gain persistence on Russian public-sector and heavy-industry targets. BleepingComputer covered it the same day. The campaign has been running since at least May 2026, according to Kaspersky, and has touched organizations in government, energy, transport, education, logistics, and industry.
Analysis, not incident reporting. What follows is a reading of Kaspersky’s published research and its context, not a claim about a specific new intrusion. Kaspersky has not named the affected organizations, and the operator behind the activity is not on the record.
The mechanics, at the level worth reporting
The technique is old-fashioned in a way worth pausing on. A malicious wtsapi32.dll is dropped into C:\Program Files (x86)\InfoTeCS\VIPNet Update System\, the install directory of the ViPNet update client. Windows’ standard DLL search order does the rest — when itcsrvup64.exe, a signed InfoTeCS binary that launches at operating-system startup, resolves its dependencies, it picks up the attacker’s file rather than the system copy. The loader Kaspersky names HelloInjector then walks its payload into svchost.exe, and from that trusted host process the rest of the tool chain unpacks: HelloProxy as a hidden proxy and secondary loader, HelloExecutor as a shell-command runner, HelloBackdoor as a Rust-written command-and-control client listening on port 443, and HelloCleaner, whose whole job is the polite one of removing the ViPNet log lines that would otherwise record any of this happening.
None of that is novel. Sideloading a bad DLL out of a signed binary’s install directory is a technique that has been in every serious intrusion set’s toolbox for a decade. It keeps working because it does not need to be novel. It exploits a trust decision the defender already made — that whatever ships out of the signed vendor’s install directory is part of the same signed intent — and that decision is not usually re-examined once made.
What Kaspersky is willing to say about who is behind it
Not much, and the restraint is the interesting part. The Securelist writeup assigns “low confidence” attribution to an unknown Chinese-speaking APT, and it does so on the basis of exactly two artifacts: an unused HTTP header string referencing news.sina.com, a Chinese-language news portal, and the fact that some of the Rust dependencies the operators pulled at build time came from the University of Science and Technology of China’s public package mirror. Kaspersky adds that “the probability of using ‘false flags’ implanted by attackers to complicate the attribution process cannot be excluded.”
Two data points, one of which is a build-artifact anyone with a Rust toolchain and a slow Western mirror might reasonably introduce, and the other of which is a string the malware does not use for anything, are not the load-bearing evidence a firm nation-state call needs. Kaspersky knows that and its language reflects it. The story here is not “China hit Russia”; the story is that a well-organized operator has been sitting inside the update path of certified Russian security software for two months and left just enough breadcrumbs to make readers reach for one attribution flag rather than another. Downstream coverage that sands “low-confidence Chinese-speaking APT” down to “China” for a cleaner headline is doing the operator a small favor.
The trust chain, and where it has broken before
The nearest historical fit is not SolarWinds, which is where the reflex reach goes. The nearer fit is the NotPetya distribution through the MeDoc updater in June 2017 — a Ukrainian tax-accounting product whose update path was subverted to seed a wiper across the country’s public and private sectors. That was a domestically-certified, domain-specific software product’s update mechanism being turned into a delivery vehicle for state-scale disruption. HelloNet is not NotPetya — it is quiet, targeted, and looks like intelligence collection rather than sabotage — but the trust decision under attack is the same one. The update client of a locally-certified security product is a durable, low-noise foothold precisely because nobody in the environment thinks of it as a place attackers would live.
The same mistake, different decade. The direction is reversed — Ukrainian software as the vector into Ukrainian orgs in 2017, Russian software as the vector into Russian orgs in 2026 — but the class of decision under attack has not moved, and the cost of that decision is roughly what it was.
What defenders elsewhere should take from it
The specific product is a Russian one, and the geopolitical framing will pull most Western coverage toward the “hackers hit Russian government” angle. The generalizable observation is drier and more useful:
- Signed update clients that resolve DLLs out of their own install directory are sideloading candidates by construction. InfoTeCS’s
itcsrvup64.exehas structural cousins everywhere — endpoint agents, backup clients, remote-management tooling, print-server utilities, niche VPN clients. The subset that launch at startup, run as SYSTEM, and resolve dependencies out of a directory a lower-privileged local user could ever write to under any misconfiguration are the ones worth an inventory pass. - Kaspersky’s detection posture is EDR-ready and generalizable. Watch for process injection into
svchost.exeoriginating from update-client processes that have no legitimate reason to inject into system services. That signature holds whether the calling binary is ViPNet’s updater, a backup agent, or a printer status app — the underlying rule is that a signed update process should not be writing memory intosvchost. Kaspersky lists two C2 IP addresses (5.39.253[.]206,176.32.34[.]135) and network activity on ports 5003, 5060, and 443 among its published indicators; the full IoC set including twelve file hashes is in the Securelist writeup. - Attribution ambiguity is not a defect of the report; it is the report. Kaspersky was careful with its language, and downstream coverage should be too. A false-flag operator counts on the sharpening step that happens between the researcher’s post and the headline.
The HelloNet campaign is not a novel technique in a novel place. It is a durable technique in a very specific place — the update path of a locally-trusted security product — that most defenders would not have thought to instrument. That is the reason to read the writeup carefully, not the reason to reach for a country name.
Sources
Found this useful? Share it.
