Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
Summary: Solar reported that a Belarus-aligned group called Partisan Zmiy, also known as the Cyber Partisans, stayed inside a Russian healthcare organization's network for nearly two years, with the intrusion discovered in December 2025 but the earliest signs of compromise dating to early 2024. The attackers planted a loader-scheduler service named vmauad in a VMware Tools directory, launching a rogue authd.exe that runs Vasilek 1.5.8 and a GOST tunnel every Saturday from 10 p.m. to 11 p.m.
What you should know: Solar hypothesizes the group skipped its usual wiper, Pryanik, because the target's two-way trusted relationships with numerous subsidiary medical institutions made the access more valuable for espionage and attacks on those partners. The backdoor sat in a trusted-but-unmonitored VMware Tools path for close to two years, and it can move the cursor and simulate user input on the victim's screen.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026