News Cyber Attacks

Two years undetected: hackers hid Vasilek backdoor inside VMware Tools in Russian healthcare network

Russian security firm Solar says attackers hid the Telegram-controlled Vasilek backdoor and tunneling tools in an unused, unmonitored VMware Tools folder inside a medical organization's network for about two years. Solar links the intrusion to the Belarus-aligned Cyber Partisans.

Published Updated
Illustration of a hospital server room where a spy figure hides inside a folder icon labeled VMware Tools, with a Telegram-style paper plane carrying data away at night.

Key takeaways

  • Attackers hid the Vasilek backdoor in an unused, unmonitored VMware Tools folder in a Russian medical network.
  • They had access for about two years, from early 2024 until discovery in December 2025.
  • Vasilek is controlled through Telegram and can log keystrokes, take screenshots and run commands.
  • Solar links the intrusion to the Belarus-aligned Cyber Partisans; the group has not confirmed it.
  • No destructive activity was seen, pointing to espionage.

Attackers stayed hidden inside a Russian medical organization's network for about two years by disguising their malware as parts of VMware Tools, according to a report by the 4RAYS team at Russian security firm Solar, as reported by Cyber Security News.

How did the attackers stay hidden? #

VMware Tools, a standard utility for virtual machines, was installed on the network but unused, and its folder was not monitored. The attackers placed their files there with VMware-like names:

File or service What it did
vmauad (shown as "VMware Auth Adapter") Loader service
authd.exe Custom loader and scheduler disguised as a VMware component
vmtools.dll Replacement for the genuine VMware library, without its digital signature; the original was renamed
vmtoolsd32.exe GOST proxy used for tunneling

The scheduler opened a GOST tunnel only on Saturdays from 10 p.m. to 11 p.m., which the researchers see as a likely backup channel. The attackers also used DNS tunneling tools.

What can the Vasilek backdoor do? #

Vasilek is a Windows backdoor controlled through a Telegram group. Version 1.5.8, analyzed by Solar, can run commands, transfer files, log keystrokes, take screenshots, collect clipboard contents and move the mouse. It checks the computer's name before activating, so it only runs on intended targets.

How long were the attackers inside? #

The earliest evidence dates to early 2024, and the intrusion was discovered in December 2025, giving the attackers roughly two years of access. How they first got in has not been established.

The victim, which was not named, has trust relationships with several subsidiary medical institutions, which the researchers see as possible next targets.

Who is behind it? #

Solar links the intrusion to a cluster it calls Partisan Zmiy, associated with the Belarus-aligned hacktivist group Cyber Partisans, based on overlapping infrastructure and techniques. The group has not publicly confirmed involvement, Ukrainian outlet dev.ua noted.

Unlike some earlier operations attributed to the group, no destructive activity was observed. The researchers believe the attackers valued ongoing access for espionage over disruption.

What should defenders learn from this? #

  1. Monitor trusted software folders, such as VMware Tools, for new or changed files, even if the software is unused.
  2. Check digital signatures of DLLs and executables in vendor directories.
  3. Investigate antivirus alerts instead of just dismissing them.
  4. Look for unusual scheduled network activity, such as tunnels that open at fixed times, and for Telegram API traffic from servers.
  5. Remove software you do not use, since unused tools make good hiding places.

Sources

  1. Solar 4RAYS report on Partisan Zmiy, Solar (4RAYS)
  2. Hackers hide Vasilek backdoor inside VMware Tools, Cyber Security News
  3. Russian researchers suspect Belarusian Cyber Partisans, dev.ua

Questions this raises

Is VMware Tools vulnerable?
No vulnerability in VMware Tools was reported. The attackers used its unmonitored folder as a hiding place and swapped in a fake, unsigned DLL.
Who was attacked?
An unnamed Russian medical organization with trust relationships with several subsidiary medical institutions.
Who is responsible?
Solar links it to Partisan Zmiy, associated with the Belarus-aligned Cyber Partisans. The group has not publicly confirmed involvement.

MalwareCyber EspionageThreat IntelligenceCritical InfrastructureHealthcareVMwareHacktivism