Full research report

Hackers abuse ViPNet software to target Russian govt agencies

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

The HelloNet campaign exploits institutional trust in a government-certified Russian VPN product to achieve persistent, elevated access across critical infrastructure. The attack's prerequisite—prior compromise of a ViPNet Administrator node—means defenders must treat the ViPNet administrative plane as a high-value target in its own right, not merely the endpoints it serves. Kaspersky's analysis reveals a professionally structured framework with dedicated components for proxy-based C2, command execution, and active evidence destruction, indicating a threat actor with detailed prior knowledge of ViPNet's internal architecture. Positive Technologies' independent investigation, identifying different second-stage malware names and an expanded C2 IP list from separate victim telemetry, raises the credible possibility that a second threat actor is exploiting the same unpatched MFTP path traversal weakness concurrently—a hypothesis that remains unresolved. The vendor has released patches, but the absence of an assigned CVE, the unresolved question of dual-actor exploitation, and the low-confidence attribution with an explicit false-flag caveat leave material analytical gaps that defenders should not treat as settled.

What happened

Since at least late May 2026, an unidentified threat actor exploited a path traversal and DLL-hijacking weakness in the ViPNet Client 4 MFTP transport protocol to deliver a multi-stage malware framework publicly named HelloNet. The campaign was reported on 17–19 July 2026 following independent investigations by Kaspersky and Positive Technologies. InfoTeCS, the ViPNet vendor, confirmed the vulnerability and released patches on 17 July 2026. A confirmed attack window of 1 June–14 July 2026 covers at least eight victim organisations across Russian critical infrastructure sectors.

Affected scope

ViPNet Client 4 versions below 4.5.3 (build 65211) for certified releases and below 4.5.5 (build 24733) for standard releases; ViPNet Administrator below version 4.6.11.5113. Affected sectors: Russian government, energy, transport, education, logistics, and industry.

Technical assessment

Attackers abused ViPNet's built-in MFTP file-transfer protocol to deliver a crafted update envelope that exploited relative-path handling, writing a malicious wtsapi32.dll into the ViPNet Update System directory via path traversal. The legitimate update service (itcsrvup64.exe) then loaded this DLL at startup through DLL sideloading. The first-stage loader (HelloInjector) injected into svchost.exe using NT API calls, establishing elevated persistence across reboots. Subsequent stages—HelloProxy, HelloExecutor, HelloCleaner, and the Rust-based HelloBackdoor—were retrieved from C2 infrastructure and provided proxied communications, command execution, network reconnaissance, and log deletion. Exploitation requires prior compromise of a trusted ViPNet Administrator node; the public internet is not a direct attack surface.

Recommended defensive actions

  1. Apply vendor patches immediately: ViPNet Client 4 to build 65211 (certified) or build 24733 (release); ViPNet Administrator to 4.6.11.5113 or later
  2. Disable the ViPNet Update System service (itcsrvup) and stop MFTP on coordinators ('mftp stop') until patching is complete
  3. Scan all ViPNet Update System directories for unexpected DLL or executable files, particularly wtsapi32.dll in non-standard paths, using the YARA rules provided by InfoTeCS
  4. Block or alert on outbound traffic to confirmed C2 IPs (5.39.253.206, 176.32.34.135, 31.57.35.21, 123.58.203.41, 154.89.152.59) on ports 5003, 5060, and 443
  5. Monitor for code injection from itcsrvup64.exe into svchost.exe and for unexpected creation or modification of Windows services
  6. Audit all ViPNet Administrator nodes for signs of prior compromise, as attacker access to an Administrator node is a prerequisite for this attack chain

Uncertainties and evidence gaps

  • No CVE identifier has been assigned to the ViPNet MFTP path traversal and DLL-hijacking vulnerability as of the reporting date
  • Attribution to a Chinese-speaking APT is low-confidence; Kaspersky explicitly flags the possibility of a deliberate false flag based on sparse and easily planted language artefacts (a sina.com string and a Chinese university Rust mirror)
  • Positive Technologies identified a distinct set of second-stage malware components (SetupChk.exe, Donnect/mocdng.dll, ShadowRelay/Diagnosis.exe) alongside the same wtsapi32.dll loader; it is not yet established whether this represents a second threat actor exploiting the same weakness, a different campaign phase, or divergent analyst naming conventions
  • The method used to achieve the prerequisite compromise of the ViPNet Administrator node has not been publicly disclosed
  • Total victim count beyond the confirmed minimum of eight organisations is unknown

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessRequires prior control of a trusted ViPNet Administrator node within the target VPN network; the public internet is not a direct entry point into the exploit chain
ComponentViPNet Client 4 MFTP transport protocol and the ViPNet Update System service (itcsrvup64.exe)
MechanismA crafted update envelope exploits relative-path handling in the MFTP service to write a malicious DLL outside its intended directory via path traversal; the legitimate update executable loads this DLL at startup (DLL sideloading), bypassing application integrity controls
ImpactPersistent, elevated-privilege code execution on victim hosts; attacker capability for proxied C2 communication, network reconnaissance, file exfiltration, and selective log erasure
DetectionPresence of wtsapi32.dll in the ViPNet Update System directory at a non-standard path; code injection events from itcsrvup64.exe into svchost.exe; outbound connections on ports 5003, 5060, and 443 to listed C2 IPs; renamed PuTTY/Plink binaries initiating reverse SSH tunnels
MitigationUpdate ViPNet Client 4 to build 65211 (certified) or build 24733 (release) and ViPNet Administrator to 4.6.11.5113 or later; disable MFTP service on coordinators until patching is complete
Exploitation status

Actively exploited in the wild since at least late May 2026; at least eight Russian organisations confirmed compromised as of 14 July 2026; no public proof-of-concept code identified.

Research process

The investigation began by verifying the BleepingComputer article and quickly located Kaspersky's Securelist report as the primary technical source. Searches for vendor and CVE records surfaced both an InfoTeCS press release confirming the vulnerability and an independent Positive Technologies investigation, providing corroboration from two organisations with separate victim telemetry. The PT Security analysis introduced a discrepancy in second-stage malware names and additional C2 IPs not present in the Kaspersky report, raising an unresolved question about whether a second actor is also exploiting the same MFTP path traversal weakness.

  1. Does the BleepingComputer source article exist and what are its verifiable claims?
    Fetched the BleepingComputer article
    bleepingcomputer.com ↗

    Article confirmed, dated 19 July 2026. Reports HelloNet campaign targeting Russian critical sectors via ViPNet update mechanism; names five malware components; cites Kaspersky as origin; attributes tentatively to Chinese APT at low confidence.

    why Establishes the baseline claims and identifies Kaspersky Securelist as the authoritative research source requiring direct verification.

  2. What does the primary Kaspersky technical report say, and what are the full technical details?
    Searched for the HelloNet Kaspersky campaign and fetched the Securelist primary advisory
    securelist.com ↗

    Full malware analysis confirmed: DLL sideloading via wtsapi32.dll using NtWriteVirtualMemory and NtCreateThreadEx for svchost injection; five named stages; C2 IPs 5.39.253.206 and 176.32.34.135; reverse SSH tunnelling via renamed PuTTY; campaign active since May 2026; false-flag caveat explicitly stated; no CVE referenced.

    why Direct malware analysis with API-level specificity confirms this is a primary investigative report, not a secondary summary. The false-flag caveat is material for attribution confidence.

  3. Has a CVE been assigned, and has the vendor issued an official advisory?
    Searched for 'ViPNet InfoTeCS DLL sideloading CVE vulnerability 2025 2026'

    No CVE identifier found. Search returned both the InfoTeCS press release and a Positive Technologies advisory dated 16–17 July 2026, plus confirmation that patch versions were released.

    why Absence of an assigned CVE is a material tracking and prioritisation gap. The vendor advisory confirms the vulnerability is real and patched.

  4. What does the InfoTeCS vendor advisory state about vulnerability mechanics, prerequisites, and patch?
    Fetched the InfoTeCS press release

    Vendor confirms exploitable relative-path handling in the MFTP transport of ViPNet Client 4; explicitly states exploitation requires prior compromise of a ViPNet Administrator node; provides YARA rules; confirms patched versions: Client 4.5.3 build 65211+ or 4.5.5 build 24733+; Administrator 4.6.11.5113+.

    why First-party confirmation of the prerequisite administrator-node compromise is critical for accurate risk scoping—this is not a remotely exploitable public-internet vulnerability.

  5. Is there independent corroboration from a second research organisation?
    Fetched the Positive Technologies advisory
    ptsecurity.com ↗

    PT Security independently confirmed the same attack vector (wtsapi32.dll via MFTP path traversal) and overlapping C2 IP (5.39.253.206), with an attack window of 1 June–14 July 2026 and at least eight confirmed victims. PT named different second-stage components (SetupChk.exe, Donnect/mocdng.dll, ShadowRelay/Diagnosis.exe) and three additional C2 IPs not present in the Kaspersky report. No threat actor attributed.

    why Independent corroboration from a separate telemetry source raises confidence in the core findings. The divergence in later-stage malware and additional C2 infrastructure introduces an unresolved question about whether a second actor is exploiting the same vulnerability in parallel.

Named in this story
ActorsUnknown Chinese-speaking APT (low-confidence attribution; false flag not excluded by Kaspersky)
MalwareHelloInjectorHelloProxyHelloExecutorHelloCleanerHelloBackdoorwtsapi32.dll (sideload loader/HelloInjector delivery)
TargetsRussian government agenciesRussian energy sectorRussian transport sectorRussian education sectorRussian logistics and industrial organisations

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 60 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok1 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1647 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok257 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok661 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Vendor & gov advisories3
HelloNet campaign: a threat via the ViPNet update system | Kaspersky Securelist securelist.com ↗

Primary technical report with full malware analysis, IoC list, MITRE ATT&CK mapping, and detection verdicts

InfoTeCS clarification on the ViPNet malware distribution incident infotecs.ru ↗

Vendor confirmation of the vulnerability, patched version numbers, and YARA detection rules

Attack via the ViPNet MFTP service: signs of compromise and recommendations | Positive Technologies ptsecurity.com ↗

Independent investigation corroborating the attack vector; identifies additional malware components and confirms at least eight victims

Analysis & research1
Hackers abuse ViPNet software to target Russian govt agencies | BleepingComputer bleepingcomputer.com ↗

English-language secondary reporting that accurately summarises the Kaspersky findings