Cyber Partisans hid Vasilek in VMware Tools for two years
Original title: Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
Vasilek 1.5.8 ran from a fake VMware Tools service and could log keys, capture screens, and move the cursor.
Solar says the Belarus-aligned cluster Partisan Zmiy, also called Cyber Partisans, stayed in an unnamed Russian healthcare network from early 2024 until discovery in December 2025. The firm says the group hid updated Vasilek in a VMware Tools path via a service named vmauad, used Telegram for control, and did not wipe systems. Initial access is unknown. The same report also describes separate JavaScript phishing that delivers HypeAgent.
Unconfirmed: Solar attributes the cluster and hypothesizes espionage; the victim name and initial access are unknown.
- Solar found the intrusion in December 2025; earliest evidence dates to early 2024.
- Service vmauad launches authd.exe, a Saturday GOST tunnel, and Vasilek 1.5.8.
- Vasilek collects host data, runs commands, transfers files, and can remove itself.
- The group has also used the Pryanik wiper and Evlx to clear Windows logs.
- A separate Solar note describes HypeAgent delivered by JavaScript email attachments.
Impact: Long-term remote control, spying, and data theft on healthcare systems
- ATT&CK
- T1036.005 Masquerading: Match Legitimate Name or LocationT1102 Web ServiceT1056.001 Input Capture: KeyloggingT1070.001 Indicator Removal: Clear Windows Event LogsT1566.001 Spearphishing Attachment
- Vendors
- VMware
- Products
- VMware Tools
- Threat actors
- Partisan ZmiyCyber Partisans
- Organizations
- Solar
From the original article
4 min read at thehackernews.com
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a track record of striking industrial
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.