Inside the Vasilek Operation: How Cyber Partisans Hid a Backdoor in VMware Tools for Two Years
Executive Summary
Between early 2024 and December 2025, a Belarus-aligned threat group known as Partisan Zmiy (Cyber Partisans) conducted a covert, nearly two-year espionage campaign inside a Russian healthcare organization's network. The attackers deployed the Vasilek backdoor (v1.5.8) by masquerading malicious executables as VMware Tools components—planting a rogue loader service ('vmauad') and replacing the legitimate 'vmtools.dll' with a malicious version. Vasilek leveraged Telegram for command-and-control and data exfiltration, activated GOST tunnels on a tight weekly schedule, and employed extensive operational security measures including timestomping, log clearing via 'Evlx,' and hostname binding. The group refrained from deploying its known Pryanik wiper, preserving access to exploit trusted relationships with subsidiary medical institutions.
This incident exemplifies a maturing shift among hacktivist-aligned threat actors toward long-duration, low-noise espionage over destructive operations. The abuse of trusted virtualization infrastructure—specifically VMware Tools directories—to conceal persistent backdoors underscores the growing risk of supply-chain-adjacent persistence techniques in healthcare and critical infrastructure environments.
Why This Matters Now
Healthcare networks remain prime espionage targets due to their sprawling trusted-subsidiary relationships and under-monitored virtualization layers. With Cyber Partisans actively expanding TTPs—including new Telegram-based C2 variants and the newly disclosed HypeAgent trojan—defenders face increasing pressure to enforce east-west traffic segmentation, monitor VMware process anomalies, and apply zero trust policies to workload-to-workload communication before exfiltration windows open.
Attack Path Analysis
The Partisan Zmiy threat actor gained initial access to a Russian healthcare organization via an unknown vector (likely phishing or exposed service) and established persistence by masquerading a malicious loader-scheduler service as a legitimate VMware Tools component, replacing VMware DLLs with a backdoored version. After quietly escalating privileges using runas and deploying the Vasilek backdoor, the attackers moved laterally across the organization's extensive infrastructure and its trusted subsidiary medical institutions, leveraging two-way trusted relationships. Command and control was maintained covertly via Telegram and GOST tunnels on scheduled nightly windows, while data and intelligence were exfiltrated over encrypted covert channels for nearly two years before discovery. The group deliberately withheld destructive impact to preserve long-term espionage access, though the capability to deploy the Pryanik wiper and clear Windows event logs with Evlx was demonstrated in prior campaigns.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The exact initial access vector is unknown; likely candidates include spear-phishing with malicious attachments or exploitation of an exposed service, consistent with Cyber Partisans' documented use of phishing lures delivering FortiClient VPN installers bundled with DNSCat2. The threat actor established a foothold on at least one host within the healthcare organization's network by early 2024.
MITRE ATT&CK® Techniques
Create or Modify System Process: Windows Service
Hijack Execution Flow: DLL Search Order Hijacking
Application Layer Protocol: Web Protocols
Web Service: Bidirectional Communication
Indicator Removal: Clear Windows Event Logs
Input Capture: Keylogging
Exfiltration Over C2 Channel
Data Destruction
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
HIPAA Security Rule (45 CFR Part 164) – Access Control and Audit Controls
Control ID: 164.312(a)(1) / 164.312(b)
NIS2 Directive (EU) 2022/2555 – Incident Handling and Supply Chain Security
Control ID: Article 21 — Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Continuous Monitoring
Control ID: Network Pillar — Macro/Micro Segmentation; Visibility and Analytics
DORA (EU) 2022/2554 – Threat Detection and ICT Incident Reporting
Control ID: Article 10 — Detection; Article 17 — ICT-Related Incident Management
ISO/IEC 27001:2022 – Security Monitoring and Network Filtering
Control ID: Annex A 8.16 — Monitoring Activities; Annex A 8.22 — Filtering of Web Services
NYDFS 23 NYCRR Part 500 – Continuous Monitoring and Incident Response Preparedness
Control ID: 500.14(b) — Monitoring; 500.16 — Incident Response Plan
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Directly targeted in the 2-year Vasilek backdoor intrusion; healthcare networks face espionage, lateral movement through trusted subsidiary relationships, and HIPAA 164.312 compliance exposure from unmonitored VMware infrastructure.
Government Administration
Partisan Zmiy historically strikes government agencies with Vasilek backdoor and Pryanik wiper; NIST 800-53 and ZTMM segmentation gaps enable prolonged C2 via Telegram and destructive post-espionage wiper deployment.
Information Technology/IT
VMware Tools DLL hijacking and vmauad loader-scheduler exploit trusted IT infrastructure; validated east-west traffic and zero trust segmentation gaps allow privilege escalation and stealthy persistence across virtualized environments.
Telecommunications
Vasilek C2 instability from Russian ISP Telegram blocks and GOST tunnel use expose telecom-dependent encrypted transit risks; Salt Typhoon-aligned encrypted traffic and egress policy enforcement deficiencies compound exfiltration exposure.
Sources
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusionhttps://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.htmlVerified
- Solar 4RAYS: Partisan Zmiy / Cyber Partisans Healthcare Intrusion Reporthttps://rt-solar.ru/solar-4rays/blog/7027/Verified
- HijackLibs Entry: vmtools.dll (VMware)https://hijacklibs.net/entries/3rd_party/vmware/vmtools.htmlVerified
- Solar 4RAYS: HypeAgent Malware Family Disclosurehttps://rt-solar.ru/solar-4rays/blog/7135/Verified
- MITRE ATT&CK: Hidden Window (T1564.003)https://attack.mitre.org/techniques/T1564/003/Verified
- DNSCat2 Open Source C2 Tool (GitHub)https://github.com/iagox86/dnscat2Verified
- Solar 4RAYS: ProxyCB Proxyware Botnet Analysishttps://rt-solar.ru/solar-4rays/blog/6652/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Partisan Zmiy sustained nearly two years of undetected access across a healthcare organization and its subsidiary network by exploiting implicit trust relationships, covert tunnels, and encrypted outbound channels — precisely the conditions that Aviatrix Zero Trust CNSF is designed to constrain. By enforcing workload-level segmentation, identity-scoped east-west policies, and controlled egress, CNSF would likely have reduced the attacker's reachability across subsidiary institutions and narrowed the viable exfiltration paths available over the intrusion's extended dwell period.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Even if initial host compromise could not be prevented, CNSF's fabric-level visibility and micro-segmentation would likely reduce the attacker's ability to reach internal workloads from that initial foothold, constraining how far the first compromised host could communicate laterally or outbound without policy authorization.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what an escalated workload identity could reach across the network, meaning even a process running with elevated local privileges would face policy-enforced boundaries that limit its ability to access adjacent hosts, services, or network segments beyond what is explicitly permitted.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to freely pivot between the primary organization and its subsidiary institutions, since implicit inter-network trust relationships would not automatically translate into permitted traffic flows — each lateral connection attempt would need to align with an explicit east-west policy rather than inherited organizational trust.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized control would likely surface the anomalous outbound communication patterns associated with Telegram-based C2 and scheduled GOST tunnel activity, and could reduce the attacker's ability to maintain reliable covert channels by constraining unrecognized or policy-violating outbound traffic paths from workloads that have no legitimate reason to initiate such connections.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely reduce the viable outbound paths available for exfiltration by constraining which workloads can initiate connections to external destinations — a healthcare workload with no legitimate need to reach Telegram infrastructure or arbitrary external endpoints would face egress policy boundaries that could limit the attacker's ability to sustain long-running covert outbound data transfers.
Had prior CNSF controls meaningfully reduced lateral reach and constrained east-west access across subsidiary institutions, the scope of assets exposed to potential wiper deployment would likely have been narrower — the attacker's ability to move the Pryanik wiper across a broad network of trusted medical institutions would depend on the same lateral paths that segmentation policies would have already worked to limit.
Impact at a Glance
Affected Business Functions
- Electronic Health Records (EHR) Access and Confidentiality
- Patient Data Management and Medical Administration
- Subsidiary Medical Institution Trusted Network Communications
- Clinical Operations and Healthcare IT Infrastructure
Estimated downtime: N/A
Estimated loss: N/A
The threat actor maintained covert access to a Russian healthcare organization's network for approximately two years (early 2024 to December 2025) without deploying destructive payloads. The Vasilek backdoor is capable of keystroke logging, screenshot capture, file transfer, and command execution, indicating a high likelihood of exfiltration of sensitive patient health data, administrative credentials, internal communications, and potentially protected health information (PHI) from the primary organization and its subsidiary medical institutions connected via trusted relationships. The attacker's restraint from destructive activity strongly suggests the priority was sustained espionage and potential lateral movement to affiliated healthcare subsidiaries, amplifying the scope of data exposure beyond the single target organization.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (microsegmentation and identity-based policy) to isolate subsidiary medical institutions from the core healthcare network, preventing the exploitation of two-way trusted relationships for lateral movement across the VMware-hosted infrastructure.
- • Deploy East-West Traffic Security controls to monitor and enforce workload-to-workload communication policies, ensuring that abnormal lateral movement between internal segments — such as pivoting from a compromised VMware host to subsidiary institution systems — is detected and blocked in real time.
- • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls to detect and block unauthorized outbound connections to Telegram, GOST tunnel endpoints, and other covert C2 channels, preventing both command-and-control and data exfiltration over encrypted covert protocols.
- • Enable Multicloud Visibility and Control to establish behavioral baselines and centralized traffic observability across the healthcare environment, enabling detection of anomalous scheduled nightly tunnel activity (Saturday 10–11 p.m. GOST sessions), time-stomped file operations, and suspicious automation indicative of a persistent implant.
- • Deploy Encrypted Traffic (HPE) controls and Inline IPS (Suricata) for inspection of data-in-transit on private circuits and cloud egress paths, ensuring that even encrypted exfiltration channels are subject to policy enforcement and that known malicious payload signatures associated with Vasilek and GOST tunneling are identified before data leaves the network perimeter.
