Hackers abuse ViPNet software to target Russian govt agencies

Kaspersky researchers report the HelloNet campaign, active since at least May, in which attackers place a malicious DLL (wtsapi32.dll, HelloInjector) into the ViPNet Update System directory to be sideloaded by a legitimate updater. The loader injects into svchost.exe, runs an in-memory proxy/loader (HelloProxy) and additional modules (HelloExecutor, HelloCleaner, HelloBackdoor) to provide remote command execution, file transfer, cleanup of ViPNet logs, and C2 communications; victims include Russian government, energy, transport, education, and logistics organizations, while attribution remains low-confidence.