Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

Belarus-aligned hacktivist group Partisan Zmiy, also known as Cyber Partisans, spent nearly two years inside the network of a Russian healthcare organization. The Vasilek backdoor was hidden in VMware Tools, according to a report by Russian cybersecurity firm Solar.

• Intrusion lasted nearly two years at a Russian healthcare organization
• Vasilek backdoor was disguised as VMware Tools
• Activity attributed to Belarus-aligned Partisan Zmiy (Cyber Partisans)
• Group active since at least 2020, targeting industrial victims