The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Kaspersky discovered the Hellsing espionage operation while investigating Naikon after a spear-phishing target refused to open a suspicious attachment and instead sent malware back to the sender. The episode was an unusual reported case of one suspected espionage actor striking another—not a safe or advisable response for ordinary recipients of suspicious email.
How the retaliation exposed Hellsing
In a technical report published on 15 April 2015, Kaspersky researchers Costin Raiu and Maxim Golovkin described encountering Hellsing during an investigation into Naikon. A target received a suspicious spear-phishing email and questioned the sender about whether it was genuine. The sender replied with a plausible organizational pretext. The target did not open the attachment; instead, it sent the sender an archive containing its own malware.
As an Amazon Associate I earn from qualifying purchases.
Kaspersky found that an executable inside the archive was a backdoor prepared for the Naikon attackers. Investigating that malware led the analysts to a separate operation, which they named Hellsing after a project name exposed in the sample’s debug information. The report recalls: “We were amazed to see this course of action and decided to investigate the ‘Empire Strikes Back’-door further; naming the actor ‘Hellsing’ (explained later).”
The backdoor could download and upload files, update itself, and uninstall itself. Kaspersky’s 2015 security bulletin called an “ATP-on-APT attack” unusual. Here, “retaliation” describes the reported incident; it is not a recommendation to send malware to a suspicious sender.
#1 Best Overall
Who Hellsing targeted
Kaspersky described Hellsing as a relatively small operation focused mainly on government and diplomatic organisations in Asia. Its technical report listed observed victims on Malaysian, Philippine, and Indonesian government networks, US diplomatic agencies, and ASEAN-related entities. It also noted older versions of the malware in India.
A Kaspersky bulletin recap estimated that around 20 organisations had been targeted. That is the researchers’ historical estimate from 2015, not a current victim count. The report assessed that Hellsing’s targeting of Naikon appeared more likely to be an attack between espionage groups than accidental overlap, but presented this as an assessment rather than definitive proof.
What the malware and overlaps show—and do not show
The report records Hellsing malware names including “msger” and “xweber,” as well as tools called “xrat,” “clare,” “irene,” and “xKat.” Kaspersky also observed infrastructure or technique overlaps with Playful Dragon/GREF, Mirage/Vixen Panda, and Cycldek/Goblin Panda. Despite those overlaps, the researchers considered Hellsing sufficiently distinct to classify as a stand-alone operation.
Those technical similarities do not establish who sponsored or controlled Hellsing. Kaspersky explicitly cautioned that attributing APT activity is difficult and said it preferred to publish technical details so others could evaluate them. The 2015 reports establish what Kaspersky described then; they do not establish Hellsing’s present-day activity or a definitive state attribution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do with a suspicious attachment
The target’s response was exceptional. For ordinary users, the useful lesson is to avoid opening unexpected files and to verify the sender through a separate, trusted channel—not to retaliate. Kaspersky’s report offered these historical defensive recommendations:
Rank #3
- Do not open attachments from unknown senders.
- Be cautious with password-protected archives, especially when they contain SCR files or other executables.
- If an attachment is uncertain, examine it in a sandbox rather than on a computer used for everyday work.
- Keep the operating system patched and update third-party applications.
These recommendations come from a 2015 report and are not a complete modern security program. The source is Kaspersky’s technical report on Hellsing; its 2015 bulletin recap gives the historical estimate of targeted organisations, and its defensive guidance discusses suspicious attachments and patching.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
