/
← Voltar ao feed
high healthcare government industrial

Cyber Partisans (Partisan Zmiy) hid Vasilek backdoor in VMware Tools in two-year intrusion at Russian healthcare organization

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 03:05 · coletado há 7 horas

Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive operations, the actors stayed in the network without disrupting it. Solar assesses this was to preserve access for espionage and trusted-relationship attacks against numerous subsidiary medical institutions. The initial access vector is unknown. The article also covers the new HypeAgent trojan, the ProxyCB botnet and a US DoJ case tied to TVRAT.

Technical Details

  • Persistence relied on a loader-scheduler Windows service (vmauad) masquerading as a VMware component. The attackers abused the trusted but unmonitored VMware Tools directory, planting executables or replacing legitimate DLLs with a malicious vmtools.dll containing the backdoor.
  • The service launches C:\Program Files\VMware\VMware Tools\authd.exe. It starts a GOST tunnel every Saturday from 10 p.m. to 11 p.m. and runs Vasilek v1.5.8 once, eight hours after the service starts.
  • Vasilek uses Telegram for C2 and exfiltration. It collects host information, runs Windows commands, starts and kills processes, transfers files, captures screenshots, logs keystrokes, escalates privileges via runas, blocks sleep mode, and can update or remove itself. A new move_cursor command simulates user input.
  • Stealth measures include hostname binding in two components, nightly scheduled payload launches, system proxy inheritance, disguise as installed but unused software, file rotation, time-stomping and outgoing message suppression. The feature set has barely changed over four revisions. Telegram blocking by Russian ISPs has made C2 unstable.
  • Other tooling tied to the group: DNSCat2 delivered with a legitimate FortiClient VPN installer via phishing, the Pryanik wiper, and the Evlx log-clearing utility.
  • Solar also described a phishing campaign using JavaScript attachments posing as payment and purchase-order documents to deliver HypeAgent. This full-featured trojan steals files and cookies (Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, Cursor), runs hidden VNC and RDP, logs keystrokes, mines cryptocurrency and tampers with the Exodus wallet to steal credentials and seed phrases.
  • Solar observed legitimate infrastructure compromised by the ProxyCB proxyware botnet, with possible overlaps to TeamSpy. The US DoJ charged Searzhudin Tamirlanovich Aktulaev for sending malicious Excel files to about 80,000 users of a freelance platform in 2016-2017, deploying TVRAT and DarkVNC.

Remediation

The article gives no explicit remediation. Defenders could monitor the VMware Tools directory for unexpected binaries or DLL replacement, and watch for the service and file names listed above.

Linha do tempo

  1. thehackernews.com ↗ · pub. 21/10/2026 03:05 · coletado 21/10 05:00 primeiro registro

    Cyber Partisans (Partisan Zmiy) hid Vasilek backdoor in VMware Tools in two-year intrusion at Russian healthcare organization

    ler a análise desta fonte

    Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive operations, the actors stayed in the network without disrupting it. Solar assesses this was to preserve access for espionage and trusted-relationship attacks against numerous subsidiary medical institutions. The initial access vector is unknown. The article also covers the new HypeAgent trojan, the ProxyCB botnet and a US DoJ case tied to TVRAT.

    Technical Details

    • Persistence relied on a loader-scheduler Windows service (vmauad) masquerading as a VMware component. The attackers abused the trusted but unmonitored VMware Tools directory, planting executables or replacing legitimate DLLs with a malicious vmtools.dll containing the backdoor.
    • The service launches C:\Program Files\VMware\VMware Tools\authd.exe. It starts a GOST tunnel every Saturday from 10 p.m. to 11 p.m. and runs Vasilek v1.5.8 once, eight hours after the service starts.
    • Vasilek uses Telegram for C2 and exfiltration. It collects host information, runs Windows commands, starts and kills processes, transfers files, captures screenshots, logs keystrokes, escalates privileges via runas, blocks sleep mode, and can update or remove itself. A new move_cursor command simulates user input.
    • Stealth measures include hostname binding in two components, nightly scheduled payload launches, system proxy inheritance, disguise as installed but unused software, file rotation, time-stomping and outgoing message suppression. The feature set has barely changed over four revisions. Telegram blocking by Russian ISPs has made C2 unstable.
    • Other tooling tied to the group: DNSCat2 delivered with a legitimate FortiClient VPN installer via phishing, the Pryanik wiper, and the Evlx log-clearing utility.
    • Solar also described a phishing campaign using JavaScript attachments posing as payment and purchase-order documents to deliver HypeAgent. This full-featured trojan steals files and cookies (Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, Cursor), runs hidden VNC and RDP, logs keystrokes, mines cryptocurrency and tampers with the Exodus wallet to steal credentials and seed phrases.
    • Solar observed legitimate infrastructure compromised by the ProxyCB proxyware botnet, with possible overlaps to TeamSpy. The US DoJ charged Searzhudin Tamirlanovich Aktulaev for sending malicious Excel files to about 80,000 users of a freelance platform in 2016-2017, deploying TVRAT and DarkVNC.

    Remediation

    The article gives no explicit remediation. Defenders could monitor the VMware Tools directory for unexpected binaries or DLL replacement, and watch for the service and file names listed above.