Russian State Security Software ViPNet Turned Into Backdoor Highway By Hackers

The attack campaign, dubbed HelloNet, hijacked the official update service of ViPNet—the military-grade encryption suite mandated across Russian government and industrial networks. Instead of patching system vulnerabilities, the update executable gladly loaded a malicious DLL file sitting in its program folder.

Once inside, the loader injected code straight into legitimate background processes, establishing a hidden proxy server named HelloProxy that hooked deeply into core networking functions to evade security filters. To make matters worse, the malware went out of its way to prevent local administrative tools from closing its control sockets.

The attacker's toolkit was remarkably well-organized, featuring custom modules to run arbitrary command-line prompts, wipe system logs, and spawn backdoor shells written in Rust. To establish persistent encrypted channels, the hackers casually hid a renamed copy of the popular PuTTY SSH utility inside the public music folder.

Security vendor Kaspersky Lab noted that artifacts inside the malware pointed toward Chinese-language developers, including references to Sina news and localized software mirrors. Meanwhile, software maker InfoTeCS admitted that a path traversal vulnerability in their transport protocol allowed anyone with network access to push malicious code disguised as official updates.

Sovereign IT architecture continues to demonstrate its absolute superiority by streamlining the infiltration pipeline for foreign actors. Standardizing national encryption protocols turns out to be remarkably efficient when everyone uses the same master key hole.