Partisan Zmiy Concealed Vasilek in VMware Tools at Russian Healthcare Target

Belarus-aligned hacktivist group Partisan Zmiy, also known as Cyber Partisans, spent nearly two years inside the network of an unnamed Russian healthcare organization, Russian cybersecurity firm Solar said. Solar discovered the intrusion in December 2025, but the earliest evidence of compromise dates to early 2024.

The attackers concealed the Vasilek backdoor, version 1.5.8, in the VMware Tools environment. A loader-scheduler service named vmauad impersonated a VMware component, providing persistence while making malicious activity less obvious during routine inspection.

Trusted VMware Tools location used for persistence

Solar observed attackers planting executables in a trusted but insufficiently monitored VMware Tools directory or replacing legitimate VMware DLLs with a malicious vmtools.dll. The service launched a rogue executable at C:\Program Files\VMware\VMware Tools\authd.exe.

That executable started a GOST tunnel every Saturday between 10 p.m. and 11 p.m. It also ran Vasilek once, eight hours after the service started. The technique illustrates how familiar product paths and component names can be used to blend malicious persistence into a Windows estate.

Backdoor supports espionage and operator control

Vasilek can inventory an infected computer, execute Windows commands, start and terminate processes, transfer files, take screenshots, record keystrokes and elevate privileges through runas. It can also prevent a system from sleeping, update or remove itself, and use its newer move_cursor command to simulate user input on the victim screen.

Partisan Zmiy has operated since at least 2020 and has targeted industrial enterprises and government agencies in Russia and Belarus. Earlier activity included Vasilek communication and data exfiltration through Telegram, phishing lures that deployed FortiClient VPN alongside DNSCat2, the Pryanik wiper, and the Evlx log-clearing utility.

Extended access appears to have taken priority

Unlike destructive operations previously associated with the group, this intrusion did not involve disruption during the observed period. Solar said the targeted organization had extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions. It hypothesised that the attackers valued that access for espionage and attacks through trusted relationships.

Solar also noted the group’s emphasis on stealth and operational security: hostname binding in two components, nightly payload launches, inheritance of system proxy settings, time-stomping, file rotation and message suppression. The Vasilek feature set has otherwise remained broadly stable across four revisions, while Telegram blocking by Russian internet service providers has made its command-and-control communication unstable.

What security teams should examine

For healthcare providers and other organisations with interconnected subsidiaries, the incident reinforces the need to inspect trusted application directories, Windows services and DLL integrity rather than treating legitimate software locations as inherently safe. Teams should investigate unexpected binaries such as authd.exe under VMware Tools, review service creation and scheduled activity, and validate trust relationships that could turn one long-lived foothold into wider access.