# Russia's Own Security Software Just Became a Backdoor Into Its Government Networks
When you certify a product for use across your most sensitive institutions, you also certify the attack surface. Russia is learning that lesson again.
A campaign Kaspersky researchers have named HelloNet has been quietly compromising Russian government agencies, energy firms, transport operators, and logistics companies since at least May — not by breaking through their defenses, but by hiding inside one of the most trusted tools those organizations run. The weapon of choice: ViPNet, an InfoTeCS-built VPN and endpoint security suite with explicit Russian government certification.
## The Trust Trap
ViPNet isn't some obscure utility. It's the kind of product that ends up in sensitive environments precisely because it carries official blessing. Russian government agencies, regulated industries, and critical infrastructure operators use it because authorities certified it. That certification is, in part, the point of the attack.
The mechanics are elegant and sobering. Attackers placed a malicious DLL — wtsapi32.dll, internally called HelloInjector — directly inside ViPNet's local update system directory. When the legitimate itcsrvup64.exe binary runs at startup, it sideloads the malicious DLL as a matter of course. The OS doesn't object. The security product doesn't object. The file is just sitting in the right place, and Windows does what Windows does.
HelloInjector then injects into svchost.exe — Microsoft's own service host process — granting the next-stage payload elevated privileges and persistence across reboots. From that foothold, a modular toolkit deploys:
The Rust-based component deserves a second look. Rust malware has become the calling card of threat actors who want both performance and evasion — compiled Rust binaries are notoriously difficult to reverse-engineer, and using port 443 for C2 traffic buries the exfiltration channel in the noise of ordinary HTTPS traffic.
## What Kaspersky Couldn't (or Wouldn't) Say
There's a critical gap in this disclosure: Kaspersky explicitly does not describe how attackers gained initial access to place HelloInjector in the ViPNet directory in the first place.
That matters enormously. Two possibilities sit at opposite ends of the severity spectrum.
If this was a supply chain compromise — if the attackers somehow injected the malicious DLL through ViPNet's actual update infrastructure — the scope of the problem extends to every organization running ViPNet globally. Kaspersky explicitly says they're not claiming ViPNet's update infrastructure was compromised, but they also don't close the door entirely.
The more likely scenario, based on the targeting pattern, is that attackers already had a foothold on these machines through some other initial access vector — spearphishing, credential stuffing, a prior unrelated compromise — and then dropped HelloInjector as a persistence and escalation mechanism once inside. That's a different threat model: HelloNet isn't the breach, it's what happens after the breach.
Kaspersky's recommendation to monitor specific ports is useful but tells you the attacker is already operating. The harder question — how they got write access to a protected security product's directory — goes unanswered.
## The Attribution Problem Nobody Wants to Talk About
Kaspersky tentatively attributes HelloNet to a Chinese-speaking APT. The evidence: an unused string referencing sina.com and a malware download mirror hosted by the University of Science and Technology of China.
They're right to assign this low confidence. Both artifacts are trivial to plant. An actor who builds a modular toolkit with memory-only execution, a log-wiping component, and port-443 C2 — and then leaves a Sina.com string sitting in dead code — is either careless in a way that contradicts every other technical choice, or they left it there on purpose.
The false flag scenario is worth taking seriously, especially given Russia-China relations in 2026. An adversary wanting to drive a wedge between Moscow and Beijing, or simply obscure their own origin, would find those breadcrumbs useful. Nation-state operations have a long history of attribution laundering.
What Kaspersky is effectively saying, reading between the lines: we found this campaign, we named it, we documented the toolset, and we have no idea who actually built it. That's the honest answer. It's also uncomfortable.
## HackWire Analysis
This isn't the first time ViPNet has been weaponized against the institutions that trust it. In April 2025 — barely 15 months ago — Kaspersky reported a separate campaign where attackers *impersonated* ViPNet updates. HelloNet represents a technical evolution: instead of spoofing updates, attackers are planting payloads inside the update system directory itself, then waiting for the legitimate binary to load them.
The pattern here fits a broader trend that deserves more attention: certified security products as high-value attack surfaces. The certification that makes an organization adopt a product also makes that product a privileged target. Security software runs with elevated privileges, is broadly trusted by endpoint defenses, and its traffic is often exempted from deep inspection. An attacker who compromises it has bypassed the entire security stack in one move.
This isn't a ViPNet-specific problem. The same logic applies to any endpoint security suite, VPN client, or IT management tool with deep system access and government certification. Western organizations should be asking uncomfortable questions about their own "trusted" vendors — particularly those used in classified or regulated environments — and whether their update and file-writing paths have the monitoring coverage they assume.
The HelloCleaner component is the detail other reporting is underweighting. Wiping ViPNet logs specifically — not the Windows event logs, not the syslog, *ViPNet's own activity records* — suggests either that the attackers understood exactly what forensic trail would expose them, or that they had prior experience with ViPNet environments. Either way, it's a sign of operational maturity that should give defenders pause.
For any org running ViPNet: immediate integrity checks on the update directory, network monitoring for outbound traffic on ports 5003, 5060, and anomalous 443 traffic from non-browser processes, and a review of which accounts have write access to ViPNet's local directories. The question of initial access isn't academic — you need to know whether HelloNet is your only problem, or just the one Kaspersky happened to name.
— HackWire Editorial
---
## Related Coverage