# Solar details VMware Tools disguise in Russian healthcare intrusion

_Published Wednesday, October 21, 2026 at 5:07 AM EDT · Security · Latest · Tier 2 — Notable_

![Solar details VMware Tools disguise in Russian healthcare intrusion — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgwNHgVe_6hmXG-V6Nx8pk56jDEW1WRCKtvvG9RHugoj65LqTTVGLvgl1Eh1E7ClmyMDn9k4RrF7Yp1kteZvZ_r7v9IxQPG_Eif3nk_13gz_MSddPcBtJdLKFwYAPa4BKMN5FdZLvvTIjahr4aTdiiLeQMuVzrj8Ff9wvgmUCW_6_OyfXPSGIEEIxZgdtQ-/s1700-nu-rw-lo-l85-e365/vmware-healthcare.jpg)

Russian cybersecurity firm Solar has disclosed how attackers hid the Vasilek backdoor in a VMware Tools directory during an intrusion at a Russian healthcare organization. Solar attributed the activity to Partisan Zmiy, also known as the Cyber Partisans, and found evidence of compromise dating to early 2024 after discovering the intrusion in December 2025.

A service masquerading as a VMware component launched a malicious executable, scheduled a weekly tunnel and delayed the backdoor's execution. Vasilek could transfer files, capture screenshots and record keystrokes. The organization had trusted connections to subsidiary medical institutions, but Solar's explanation that attackers preserved access for espionage and further attacks remains a hypothesis.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html)

---
Canonical: https://techandbusiness.org/newswire/3WZfgNynSlvQIlE3oY_aEO
Published: 2026-10-21T09:07:04.294Z
Story chronology: 2026-10-21T06:05:15.000Z
Retrieved: 2026-10-25T06:20:24.667Z
Publisher: Tech & Business (techandbusiness.org)