Solar Reports Vasilek Backdoor Hidden in VMware Tools During Russian Healthcare Intrusion
Summary
Solar says Partisan Zmiy maintained access to an unnamed Russian healthcare organization from at least early 2024 until discovery in December 2025, hiding Vasilek backdoor components in a VMware Tools directory.
Key points
- Solar attributed the intrusion to Partisan Zmiy, also known as the Cyber Partisans; the targeted healthcare organization was not named.
- The Rostelecom subsidiary discovered the intrusion in December 2025, while evidence suggests compromise began in early 2024. The initial access method is unknown.
- A service named vmauad masqueraded as a VMware component and launched a rogue executable; attackers reportedly planted malicious files or replaced VMware DLLs in a VMware Tools directory.
- The Vasilek backdoor could collect system information, run commands, transfer files, capture screenshots, record keystrokes and escalate privileges.
- The attackers reportedly maintained access without destructive activity. Solar hypothesized that access to the organization’s infrastructure and trusted links to medical institutions could support espionage or further attacks.
- Solar said Telegram-based command-and-control had become unstable because Telegram was blocked by Russian internet service providers.
Article Details
- Event Type
- Cyber intrusion attributed by Solar to the Belarus-aligned threat cluster Partisan Zmiy, which remained inside a Russian healthcare organization's network for nearly two years and used a backdoor hidden in VMware Tools.
- Impact
- The attackers maintained persistence and espionage capabilities, including information collection, command execution, file transfer, screenshots, keystroke recording, and privilege escalation. Solar reported no destructive activity during this intrusion; the targeted organization was not identified.
MITRE ATT&CK
T1056.001 · KeyloggingVasilek could record keystrokes.T1059 · Command and Scripting InterpreterVasilek could execute Windows commands.T1070.001 · Clear Windows Event LogsThe group used Evlx to systematically clear Windows event logs.T1113 · Screen CaptureVasilek could capture screenshots.T1543.003 · Windows ServiceThe attackers used a Windows service to launch a rogue binary and maintain persistence.
Threat Actors
Malware
PryanikA notable aspect of the threat actor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.Vasilekof striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration.
Products
FortiClient VPNalso leveraged phishing lures to deliver an installer that simultaneously deploys the legitimate FortiClient VPN program on the system as well as an open-source program known as DNSCat2 that allows attackers toMicrosoft WindowsA notable aspect of the threat actor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.Telegramenterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration.VMware ToolsTo accomplish this, the attackers are said to have taken advantage of a trusted-but-unmonitored VMware Tools directory location to plant malicious executables or replace legitimate VMware DLLs with a malicious
Tools
DNSCat2deploys the legitimate FortiClient VPN program on the system as well as an open-source program known as DNSCat2 that allows attackers to gain control of the infected host.EvlxA notable aspect of the threat actor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.
Countries
BelarusA Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.Russiaat least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data