Hackers Abuse ViPNet Software Update Mechanism to Target Russian Government Agencies
An advanced threat actor is exploiting the update mechanism of Russia's ViPNet private networking software to deliver malware to government agencies and other critical organizations.
A sophisticated threat actor, tracked as HelloNet, has been actively abusing the update mechanism for the ViPNet private networking software suite to target Russian organizations, including government agencies, since at least May. Researchers at Kaspersky have identified this campaign, which deploys a malicious payload designed to act as a proxy and loader for further malware.
ViPNet is a widely used suite of information-security products developed by InfoTeCS in Russia, offering VPN, endpoint protection, firewall, and secure messaging capabilities. It is certified for use within Russian government and regulated environments, making it a high-value target for attackers seeking access to sensitive data and systems within these entities.
The attackers' method involves placing a malicious DLL, identified as 'HelloInjector,' into the local ViPNet Update System directory. This DLL is then sideloaded at system startup by the legitimate 'itcsrvup64.exe' process. Upon execution, HelloInjector injects itself into the 'svchost.exe' process, granting elevated privileges and establishing persistence across reboots. While Kaspersky did not specify the initial access vector, they noted that ViPNet's update infrastructure itself does not appear to have been compromised.
Once loaded, HelloInjector executes its embedded payload, named 'HelloProxy,' in memory. This component communicates with a command-and-control (C2) server to download additional modules. These modules include 'HelloExecutor,' a backdoor capable of executing commands and performing network reconnaissance, and 'HelloCleaner,' a tool designed to erase ViPNet log data to conceal malicious activity.
Further complicating the attack chain, another implant named 'HelloBackdoor' has been observed. This backdoor, written in Rust, provides capabilities for uploading and downloading files and executing commands on compromised systems. The multi-stage nature of the malware allows the attackers to maintain a flexible and persistent presence within targeted networks.
Kaspersky has tentatively attributed the HelloNet campaign to an unidentified Chinese-speaking advanced persistent threat (APT) group. However, the evidence supporting this attribution is considered weak, based primarily on an unused string referencing a Chinese website and a malware download mirror hosted by a Chinese university. The researchers acknowledge the possibility of a false flag operation and assign the attribution with low confidence.
The campaign has impacted organizations across various critical sectors, including government, energy, transport, education, and logistics. Kaspersky recommends that organizations running ViPNet software implement thorough monitoring, paying close attention to network traffic on ports 5003 and 5060, which are used by HelloProxy, and port 443, associated with HelloBackdoor, to detect and mitigate potential compromises.