Report: Vasilek backdoor hidden in VMware Tools during long intrusion at Russian healthcare org

Past-week coverage · Original source published 2026-10-21.

A Belarus-aligned hacktivist group spent nearly two years inside the network of a Russian healthcare organization, according to a report from the Russian cybersecurity firm Solar. The Hacker News summarized the findings on Oct 21, 2026.

Solar attributed the activity to a threat cluster it calls Partisan Zmiy, also known as the Cyber Partisans. The group is said to have been active since at least 2020 and to have a track record of striking industrial targets, though the retained source gives no further detail on that history.

The headline finding is the hiding place: the intruders placed a backdoor called Vasilek inside VMware Tools, the utility set that commonly runs on virtual machines and is often trusted by administrators. That choice matters because tooling bundled with virtualization platforms tends to blend into routine system activity and may sit outside the scope of endpoint controls tuned for ordinary malware.

The retained source does not describe how initial access was gained, which versions of VMware Tools were involved, or whether the backdoor abused a vulnerability rather than simply masquerading as a legitimate component. It also does not say whether the healthcare organization has contained the intrusion.

For defenders, the practical lesson is to treat management and guest utilities as part of the attack surface: inventory them, verify their integrity against vendor-supplied files, and watch for unexpected changes to their binaries or configuration. The source offers no specific detection guidance beyond the reported technique.

The attribution comes from a single vendor and should be read as Solar's assessment, not an established fact.