Solar details VMware Tools disguise in Russian healthcare intrusion
Image: Primary Russian cybersecurity firm Solar has disclosed how attackers hid the Vasilek backdoor in a VMware Tools directory during an intrusion at a Russian healthcare organization. Solar attributed the activity to Partisan Zmiy, also known as the Cyber Partisans, and found evidence of compromise dating to early 2024 after discovering the intrusion in December 2025.
A service masquerading as a VMware component launched a malicious executable, scheduled a weekly tunnel and delayed the backdoor's execution. Vasilek could transfer files, capture screenshots and record keystrokes. The organization had trusted connections to subsidiary medical institutions, but Solar's explanation that attackers preserved access for espionage and further attacks remains a hypothesis.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
