Russian organizations targeted by backdoor masquerading as secure networking software updates

Kaspersky investigated a sophisticated backdoor delivered in April 2025 by malicious LZH archives masquerading as ViPNet updates targeting government, finance, and industrial organizations in Russia; the archive used a legitimate updater (lumpdiag.exe) and path-substitution to run a malicious loader (msinfo32.exe) which decrypts and loads a backdoor capable of C2 communication and file theft, with associated hashes and file paths provided as IOCs.