Vasilek Backdoor Hid Inside VMware Tools for Nearly Two Years in Russian Healthcare Network

A Belarus-aligned hacktivist cluster quietly kept access to a Russian healthcare organization for close to two years. Its main trick was to make its malware look like part of VMware Tools, one of the most trusted and least-watched pieces of software on a virtualized Windows estate.

What happened

Researchers at Russian security firm Solar, a Rostelecom subsidiary, attribute the intrusion to a cluster tracked as Partisan Zmiy, also known as the Cyber Partisans. The group has been active since at least 2020 and has hit industrial and government targets in Russia and Belarus with Vasilek, a backdoor that uses Telegram for command-and-control and data theft.

Key points from the investigation:

• Timeline. The victim spotted the intrusion in December 2025. Evidence points to the first compromise in early 2024. The organization has not been named, and the initial access vector is still unknown.
• Hiding in VMware Tools. The attackers installed a loader/scheduler service, vmauad, made to look like a genuine VMware component. They put malicious executables in the VMware Tools directory and swapped legitimate VMware DLLs for a trojanized vmtools.dll.
• Scheduled activity. A rogue authd.exe in the VMware Tools folder opened a GOST tunnel every Saturday between 22:00 and 23:00. It also started an updated Vasilek build (v1.5.8) once, eight hours after the service came up.
• Capabilities. Vasilek profiles the host, runs commands, manages processes, moves files, takes screenshots, logs keystrokes, escalates via runas, keeps the machine awake, and can update or remove itself. A new move_cursor command lets operators simulate user input on screen.
• Stealth over new features. Solar notes that the group puts its effort into tradecraft rather than new functionality. Examples include hostname binding, nightly scheduled launches, inheriting system proxy settings, time-stomping, rotating files across the same paths, and suppressing outgoing messages.

The campaign also departs from the group's earlier work. In the past, the Cyber Partisans have staged destructive attacks with the Pryanik wiper and cleared Windows event logs with a tool called Evlx. This time nothing was disrupted. Solar's working hypothesis is that the victim's trusted links to many subsidiary medical institutions made quiet, long-term access more valuable than sabotage. That reading is the researchers' hypothesis, not a confirmed motive.

Other operations linked to the group have used phishing lures that drop a legitimate FortiClient VPN installer together with the open-source DNSCat2 tool for remote control.

Why it matters

Two lessons apply well beyond this one victim:

1. Trusted paths are blind spots. Security teams often allow-list or ignore folders like C:\Program Files\VMware\VMware Tools\. A malicious DLL or service there can get past casual review for months.
2. Healthcare is a pivot point. One healthcare group with trusted connections to many hospitals and clinics gives an attacker a route into all of them. Quiet persistence in that position is a supply-chain risk, not just a single breach.

What to do

• Baseline vendor software directories. Hash the files in VMware Tools and other agent/driver folders and alert on any unsigned or unexpected binary or DLL, especially vmtools.dll replacements and unfamiliar executables such as authd.exe.
• Audit Windows services. Look for services that use vendor-like names (for example vmauad) but have no matching signed vendor binary, unusual start types, or image paths that don't fit.
• Watch for scheduled tunnels. Flag outbound connections that only appear in narrow weekly windows, as well as tunnelling tools such as GOST or DNSCat2.
• Restrict Telegram traffic from servers. Production and clinical hosts rarely need to reach Telegram's API. Block it or alert on it.
• Protect your logs. Forward event logs off-host so a log-wiping tool can't erase your timeline.
• Check for time-stomping. Compare file timestamps with installer records and MFT metadata, not just what Explorer shows.

Long-dwell intrusions like this usually go unnoticed because nobody is actively testing whether the "trusted" parts of an environment can be abused. Our penetration testing team checks exactly this, including whether persistence in vendor directories and services would be caught by your current monitoring. It's worth knowing the answer before an attacker finds out.

This article summarizes research published by Solar and reported by The Hacker News.