Threats · 9h ago
Solar attributed a nearly two-year intrusion into a Russian healthcare network to the Cyber Partisans, who concealed their Vasilek backdoor in VMware Tools. The organization discovered the intrusion in December 2025; evidence pointed to compromise dating back to early 2024. Its name and the initial access method have not been disclosed.
The attackers placed malicious files in a VMware Tools directory and used a Windows service disguised as a VMware component to launch them. They also replaced a legitimate VMware file with a malicious version containing the backdoor. Blending into software directories defenders may trust or monitor less closely helped the attackers maintain a quiet foothold.
The victim had trusted, two-way connections with subsidiary medical institutions. Solar suggests those links may have been valuable for espionage or further access. If the compromised network could reach those affiliates, removing malware from the VMware host alone would not establish whether the connected institutions were also exposed.
1 source covering this story
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
Belarus-aligned Cyber Partisans maintained access to a Russian healthcare network for nearly two years, hiding Vasilek malware in VMware Tools.
Part of the PlainSec briefing for 2026-10-21