The program for secure document management, which is used by Russian companies and government agencies, has become a tool for infiltrating their own networks - an attack was detected through the standard functionality of the ViPNet FFTP service.
Specialists of the expert security center Positive Technologies recorded signs of an attack that lasted at least from June 1 to July 14, 2026 and affected at least eight organizations.
The mechanism is built on the abuse of the built-in transport protocol MFTP, through which ViPNet customers exchange files. The attackers sent a special file envelope between the nodes with the extension .ctl, inside of which was the malicious library wtsapi32.dll. It was loaded by the ViPNet update service by changing the system file (DLL Hijacking) technique and a vulnerability that allows you to record the file in the folder for which it is intended.
After launch, the library acted as a bootloader: it was looking for the svchist.exe process and built additional malicious code into it. The infected system turned into a proxy server, through which attackers redirected network traffic and uploaded other malware into memory, thereby bypassing security tools aimed at searching for disk files.
A separate episode was the distribution at the end of May 2026 of the fake service package, inside which were the programs SetupCheck.dll and SetupChk.exe. They cleared ViPNet logs to hide the intrusion traces, and at the same time collected data about processes, network connections and installed software on the infected device, preparing a new malicious envelope for further distribution.
During the investigation, the Donnect bootloader and ShadowRelayShadowRelay backdoor, which disguised as a oneDrive-recided service, were also found on the compromised nodes and connected to external control servers.
InfoTEX confirmed the discovery of the vulnerability and clarified the conditions of its operation: the attack is possible only if the attackers have already gained control over the node with the ViPNet Administrator. It is from this compromised control node through the connections between networks that a fake update envelope is sent, which uses the vulnerability of relative paths to increase privileges and execute arbitrary code on the attacked nodes.
To eliminate the vulnerability, the company has released updated versions of products: ViPNet Client 4,3 version 4.5.3 of 6.53 assemblies 6,211 and higher, version 4.5.5 of the build 24733, which will be available soon, as well as ViPNet version of 4.6.11.5113 and above. Organizations whose networks are associated with other protected networks, InfoTEX recommends checking nodes for signs of infection using prepared YARA rules and, if suspicious or unusual network activity is detected, contact the technical support service of the company immediately.
To reduce the risk, it is recommended to stop and disable the ViPNet update service on all workstations and servers, and at HW and xFirewall coordinators, stop the MFTP service. It is also worth making sure that users of ViPNet network nodes do not have the authority of the administrator, update the antivirus software in a timely manner and monitor the relevance of the versions of the installed ViPNet products.
Specialists of the expert security center Positive Technologies recorded signs of an attack that lasted at least from June 1 to July 14, 2026 and affected at least eight organizations.
The mechanism is built on the abuse of the built-in transport protocol MFTP, through which ViPNet customers exchange files. The attackers sent a special file envelope between the nodes with the extension .ctl, inside of which was the malicious library wtsapi32.dll. It was loaded by the ViPNet update service by changing the system file (DLL Hijacking) technique and a vulnerability that allows you to record the file in the folder for which it is intended.
After launch, the library acted as a bootloader: it was looking for the svchist.exe process and built additional malicious code into it. The infected system turned into a proxy server, through which attackers redirected network traffic and uploaded other malware into memory, thereby bypassing security tools aimed at searching for disk files.
A separate episode was the distribution at the end of May 2026 of the fake service package, inside which were the programs SetupCheck.dll and SetupChk.exe. They cleared ViPNet logs to hide the intrusion traces, and at the same time collected data about processes, network connections and installed software on the infected device, preparing a new malicious envelope for further distribution.
During the investigation, the Donnect bootloader and ShadowRelayShadowRelay backdoor, which disguised as a oneDrive-recided service, were also found on the compromised nodes and connected to external control servers.
InfoTEX confirmed the discovery of the vulnerability and clarified the conditions of its operation: the attack is possible only if the attackers have already gained control over the node with the ViPNet Administrator. It is from this compromised control node through the connections between networks that a fake update envelope is sent, which uses the vulnerability of relative paths to increase privileges and execute arbitrary code on the attacked nodes.
To eliminate the vulnerability, the company has released updated versions of products: ViPNet Client 4,3 version 4.5.3 of 6.53 assemblies 6,211 and higher, version 4.5.5 of the build 24733, which will be available soon, as well as ViPNet version of 4.6.11.5113 and above. Organizations whose networks are associated with other protected networks, InfoTEX recommends checking nodes for signs of infection using prepared YARA rules and, if suspicious or unusual network activity is detected, contact the technical support service of the company immediately.
To reduce the risk, it is recommended to stop and disable the ViPNet update service on all workstations and servers, and at HW and xFirewall coordinators, stop the MFTP service. It is also worth making sure that users of ViPNet network nodes do not have the authority of the administrator, update the antivirus software in a timely manner and monitor the relevance of the versions of the installed ViPNet products.
