Cyber Partisans Hide Vasilek Backdoor in VMware Tools During Russian Healthcare Intrusion

"The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions," Solar said.

Who the intruders are and the target they reached

Solar, a Russian cybersecurity firm, attributes the prolonged intrusion to a Belarus-aligned hacktivist cluster it calls Partisan Zmiy, also known as the Cyber Partisans. The intrusion affected a Russian healthcare organization whose name Solar did not disclose. A Rostelecom subsidiary discovered the activity in December 2025, though Solar found evidence that the earliest signs of compromise date back to early 2024 — a span of nearly two years in which the attackers remained on the network.

Vasilek backdoor hidden in VMware Tools and how persistence was achieved

Central to the intrusion was a loader-scheduler service named "vmauad" that masqueraded as a legitimate VMware component to maintain persistence and evade cursory inspection. The attackers abused a trusted-but-unmonitored VMware Tools directory to plant malicious executables or to replace legitimate VMware DLLs with a malicious "vmtools.dll" containing the Vasilek backdoor. The rogue Windows service launches the binary at C:\Program Files\VMware\VMware Tools\authd.exe; that component both launches a GOST tunnel every Saturday from 10 p.m. to 11 p.m. and runs Vasilek version 1.5.8 once, eight hours after the service begins.

Vasilek capabilities, new behavior, and operational security

Solar describes Vasilek as a mature backdoor that collects system information, executes Windows commands, launches and terminates processes, transfers files, captures screenshots, records keystrokes, escalates privileges via runas, prevents sleep, and can update or remove itself. A newly observed command, "move_cursor," lets the backdoor move the cursor and simulate user input on the victim's screen. Solar also noted the group’s consistent investment in stealth and operational security rather than new offensive capabilities: hostname binding across components, nightly scheduled payload launches, system proxy inheritance, disguise as legitimately installed-but-unused software, file rotation on fixed paths, time‑stomping, suppression of outgoing messages, and anonymous operator chat posts.

Not a destructive operation — shift in modus operandi

Unlike other attacks linked to the Cyber Partisans that have deployed destructive tools such as the Pryanik wiper and used Evlx to clear Windows event logs, this campaign featured no recorded destructive actions. Solar hypothesizes the absence of disruption reflects the value of the access for espionage and for attacks that exploit trusted relationships between the compromised organization and its subsidiary medical institutions.

Related malicious tools and broader activity Solar disclosed

Alongside the Vasilek intrusion, Solar disclosed a phishing campaign that delivered a previously unreported malware family called HypeAgent via JavaScript attachments posing as business documents. HypeAgent is described as a full-featured Windows trojan able to steal files, open a console, change desktop wallpaper, enable webcams, log keystrokes, launch hidden VNC and RDP sessions, control the mouse, and deploy a cryptocurrency miner. It can also steal cookies associated with Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, and Cursor, and it can tamper with the Exodus wallet app by injecting JavaScript to collect passwords, PINs, mnemonic phrases and private keys.

Solar additionally observed legitimate infrastructure compromised by the ProxyCB proxyware botnet making automated requests to Russian websites and flagged possible overlaps between that botnet infrastructure and historical TeamSpy activity, which abused TeamViewer for reconnaissance and data theft.

What this means for Russian healthcare organizations, security teams, and software vendors

• Russian healthcare organizations: The long dwell time without destructive activity underlines Solar's point that persistent access can be more valuable than immediate disruption where two‑way trusted relationships with subsidiary institutions exist; organizations that share trust relationships should re-evaluate those paths for lateral access.
• Enterprise security teams: The abuse of VMware Tools directories and the vmauad/vmtools.dll persistence technique highlights the need to monitor trusted-but-unmonitored application paths, schedule-based payload behavior (including weekly tunnels), and unusual replacements of vendor DLLs.
• Software vendors and defenders of communications platforms: Solar reports that Vasilek used Telegram for C2 and exfiltration, and that Telegram blocking by ISPs in Russia made C2 unstable; defenders should note the impact of platform availability on adversary tradecraft and the resulting operational adaptations.

Solar's findings show a group that retains destructive capability yet chose long-term covert access in a healthcare environment likely rich in privileged relationships. The intrusion used a familiar mix of social engineering, trusted-software abuse, and careful scheduling; it leaves a concrete question for defenders: which trusted deployment paths—like VMware Tools directories—are being assumed safe but are in practice unmonitored, and how quickly can those assumptions be changed?

Original reporting: https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html