Vasilek backdoor hid in fake VMware Tools for two years

Russian security firm Solar (a Rostelecom subsidiary) reports that a Belarus-aligned hacktivist group it tracks as Partisan Zmiy — also known as the Cyber Partisans — spent roughly two years inside a Russian healthcare organization, running a Telegram-controlled backdoor called Vasilek that masqueraded as a VMware Tools component. The finding, reported by The Record, is a persistence-and-stealth story, not a destruction one: despite long access, the operators did not disrupt systems.

Who and how long

Solar discovered the intrusion in December 2025; the earliest evidence dates to early 2024. The victim, unnamed, is described as having two-way trusted relationships with numerous subsidiary medical institutions — the kind of hub that makes lateral reach into smaller clinics easy. Initial access is unknown.

The VMware Tools disguise

The attackers planted their loader in the legitimate, usually unmonitored VMware Tools directory. A Windows service named vmauad, posing as a VMware component, launched a rogue binary at:

C:\Program Files\VMware\VMware Tools\authd.exe

Per Solar's analysis (and corroborating Russian-language reporting at SecurityLab), the group replaced the legitimate vmtools.dll with the Vasilek 1.5.8 backdoor. The service runs a GOST tunnel every Saturday from 10 p.m. to 11 p.m. and launches Vasilek once, eight hours after the service starts — timing that keeps noise low. Vasilek talks to its operators over Telegram; Solar notes the channel has become unstable because Telegram is throttled in Russia. A new command in this version, move_cursor, simulates user input.

Attribution — hedged

Solar attributes the activity to Partisan Zmiy on infrastructure and technique overlap, and frames the lack of destructive activity as a hypothesis: the access itself, and the trusted links to subsidiary institutions, were worth more than disruption. Kaspersky first documented Vasilek in 2025; Solar says the version it examined is newer. The Cyber Partisans separately claimed a 2023 breach of a Moscow health body — a claim that is not independently verified and is distinct from Solar's findings. Solar also tied the Pryanik wiper, the Evlx event-log cleaner, and a phishing-delivered HypeAgent trojan to the group's broader operations.

Action checklist

1. Treat the VMware Tools directory as a monitored path, not a trusted one. Alert on new or modified executables and DLLs under C:\Program Files\VMware\VMware Tools\, especially authd.exe and a replaced vmtools.dll.
2. Hunt for a Windows service named vmauad (or other VMware-looking service names you did not create) and for binaries whose signatures do not match VMware's.
3. Watch for scheduled, time-boxed outbound tunnels (the GOST tunnel ran in a fixed Saturday-night window) and for Telegram-based C2 from server workloads.
4. Solar's full report carries the technical detail; pull hashes and infrastructure from it rather than from secondary writeups, which did not publish usable IOCs.

Context

Hiding a loader inside a signed vendor's install directory is an old sideloading trick given a long runway here: two years, a hub healthcare network, and C2 that only degraded because of a censorship side effect rather than defender action. The lesson for blue teams is that "trusted vendor directory" is exactly where a patient actor expects you not to look.