Threat reportAPTTL-2026-4406
Vasilek Backdoor Hidden in Trojanized VMware Tools During Two-Year Intrusion at Russian Healthcare Organization (Partisan Zmiy)
Vasilek Backdoor Hidden in Trojanized VMware Tools During (TL-2026-4406), also tracked as Vasilek campaign, is a high-severity advanced persistent threat campaign, first published 2026-10-24. It is attributed to Partisan Zmiy (Belarus) with medium confidence, affects Microsoft Windows (servers and workstations in the victim environment), maps to 20 MITRE ATT&CK techniques (T1021.001, T1021.002, T1027.002), and is covered by 9 detection rules and 32 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 2Partisan Zmiy
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-4406
- Threat ID
- TL-2026-4406
- Also known as
- Vasilek campaign, Solar 4RAYS Partisan Zmiy healthcare investigation
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Partisan Zmiy, Cyber Partisans
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Belarus
- Motivation
- HACKTIVISM
- Target sectors
- health, government administration, industrial
- Target regions
- russia, belarus
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in Vasilek Backdoor Hidden in Trojanized VMware Tools During
Malware and tooling: HypeAgent, Pryanik, Vasilek, GOST, Impacket - S0357, Wmiexec
How Vasilek Backdoor Hidden in Trojanized VMware Tools During works
Belarus-aligned hacktivist group Partisan Zmiy (Cyber Partisans) maintained a nearly two-year intrusion in a Russian healthcare organization, persisting through a loader-scheduler service and DLLs masquerading as VMware Tools components. Tooling included the Telegram-controlled Vasilek backdoor (v1.5.8), GOST/3proxy tunnels, DNSCat2 and PartisanDNS; the group also operates the Pryanik wiper and Evlx log-clearing utility.
Solar 4RAYS (Rostelecom-Solar) investigated an intrusion at a Russian healthcare organization with extensive infrastructure and trusted relationships with subsidiary medical institutions. Evidence of compromise dates to early 2024; the intrusion was discovered in December 2025 and the Solar report (rt-solar.ru/solar-4rays/blog/7027/) was published in October 2026. The initial access vector is unknown. Observed command execution matched Impacket wmiexec.py (output redirected to \\127.0.0.1\ADMIN$\__<timestamp>.<microseconds>), scanning activity originated from a subsidiary medical organization, and lateral movement used RDP with legitimate credentials and SMB/ADMIN$ command execution.
Persistence relied on a previously undescribed scheduler-loader, authd.exe, installed as the service 'vmauad' (display name 'VMware Auth Adapter') in C:\Program Files\VMware\VMware Tools\. It runs payloads on a cron-like/interval schedule: one GOST tunnel every Saturday 22:00-23:00, and an updated Vasilek (v1.5.8) launched once eight hours after the service starts, to separate malicious traffic from boot activity. Payloads were hidden under VMware/WSUS-like names (rpctool32.exe = Vasilek, vmtoolsd32.exe and E:\WSUS\UpdateServicesPackages\WsusService.exe = GOST); the legitimate vmtools.dll was replaced with an unsigned malicious DLL while the original vmtoolsd.dll was retained. Additional services masqueraded as Windows or third-party components ('Windows Insiders Service' tpvmmon, 'Windows Channels Service' aweman32, 'Sybase Inc. Product File' msadcs32, 'Access FT Imager Service' uplay_r164) and loaded UPX-packed DNSCat2 or the custom PartisanDNS DNS tunnel (with DGA domains). AppMgmt service parameters were temporarily modified for execution, and ConsentPromptBehaviorAdmin was modified under the Policies\System registry key.
Vasilek is a 32-bit Windows backdoor with a 59-entry command table (Vigenere-encrypted), OLLVM control-flow flattening, encrypted strings and dynamically resolved APIs. It is controlled through the Telegram Bot API (getUpdates long polling, group chat with an anonymous group bot), and checks a salted SHA-256 hash of the computer name before running so it only operates on the intended host. Capabilities include command execution via cmd.exe, process creation, file upload/download, screenshots, keylogging, clipboard collection, UAC bypass via runas (cadmin/force_cadmin), suppression of outgoing messages (mute), self-update (update/wget) and removal, and a new move_cursor command that simulates user input. Telegram being blocked by Russian ISPs made the C2 channel unstable, which is why GOST and DNS tunnels were kept as alternates. Other operational-security measures included hostname binding in two independent components, nightly scheduled payload launches, system proxy inheritance, disguise as installed-but-unused software, file rotation across the same paths, time-stomping and outgoing message suppression.
Solar also observed HypeAgent, a previously unreported trojan delivered via JavaScript attachments posing as payment or purchase-order documents, with remote control, webcam, hidden VNC/RDP, crypto-mining, cookie theft from many services and Exodus wallet tampering. Unlike earlier Cyber Partisans operations (Kaspersky ICS CERT, June 2025), the actors did not run destructive tooling during the dwell time; researchers assess the access was retained for espionage and trusted-relationship attacks against connected medical entities. The group's Pryanik wiper is a logic bomb that triggers at preset times and can re-trigger about a month later if not removed. Russia's Supreme Court designated Cyber Partisans an extremist organization in July 2026. No CVE was involved.
MITRE ATT&CK techniques used in TL-2026-4406
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027.002 Software Packing; T1036.004 Masquerade Task or Service; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1480.001 Environmental Keying
Execution
T1047 Windows Management Instrumentation; T1059.003 Windows Command Shell; T1569.002 Service Execution
Collection
T1056.001 Keylogging; T1113 Screen Capture
Command and Control
T1071.004 DNS; T1090 Proxy; T1102.002 Bidirectional Communication; T1568.002 Domain Generation Algorithms
defense-impairment
Persistence
Privilege Escalation
T1548.002 Bypass User Account Control
stealth
Affected products and versions in Vasilek Backdoor Hidden in Trojanized VMware Tools During
Remediation for Vasilek Backdoor Hidden in Trojanized VMware Tools During
Patches
- No CVE or vendor patch - the intrusion abuses legitimate software paths and valid accounts
Immediate actions
- Hunt for service 'vmauad' (VMware Auth Adapter) and authd.exe, rpctool32.exe, vmtoolsd32.exe, vmtools.dll in C:\Program Files\VMware\VMware Tools\ on hosts where VMware Tools is not expected or the files are unsigned
- Hunt for services tpvmmon, aweman32, msadcs32, uplay_r164 and DLLs loaded from C:\Windows\System32 with those names; review Windows System Event ID 7045
- Block the published C2 and DGA domains and review DNS logs for DNS tunneling (DNSCat2/PartisanDNS) and Telegram Bot API traffic from servers
- Hunt for \\127.0.0.1\ADMIN$\__<timestamp> output files indicating Impacket wmiexec.py activity
- Reset credentials used for RDP/SMB on affected segments and review activity from subsidiary medical organization networks
Workarounds
- Remove unused VMware Tools installations from non-virtualized or unneeded hosts
- Application allowlisting for the VMware Tools and WSUS package directories
Longer-term hardening
- Verify digital signatures of VMware Tools binaries and baseline expected files; alert on unsigned DLL replacement
- Monitor for scheduled GOST tunnels and unexpected proxy/tunneling tools on servers
- Restrict outbound traffic from servers to messaging APIs and non-approved DNS resolvers
- Deploy EDR with behavioral detection of service creation and time-stomping; protect and centralize event logs against clearing (Evlx)
- Segment and monitor trust relationships between the organization and subsidiary medical institutions
Timeline of Vasilek Backdoor Hidden in Trojanized VMware Tools During
- Cyber Partisans (Partisan Zmiy) known to be active since at least 2020, targeting Russian and Belarusian industrial and government entities (approximate year; day/month not stated in sources)
- Earliest evidence of compromise of the Russian healthcare organization dates to early 2024 (exact date not stated)
- Kaspersky ICS CERT publishes TTPs of Cyber Partisans, documenting the Vasilek Telegram backdoor and Pryanik wiper in attacks on Russian and Belarusian entities
- Intrusion discovered in December 2025; Solar 4RAYS joins the investigation (exact day not stated)
- Russia's Supreme Court designates Cyber Partisans an extremist organization (July 2026, exact day not stated)
- Solar 4RAYS publishes its report on the two-year Partisan Zmiy intrusion, including the vmauad scheduler-loader and Vasilek v1.5.8
- The Hacker News and other outlets publish coverage of Vasilek hidden in trojanized VMware Tools
Sources cited for Vasilek Backdoor Hidden in Trojanized VMware Tools During
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
- Solar 4RAYS: Partisan Zmiy intrusion at a medical organization
- The Record: Belarusian hacktivists spent two years in Russian healthcare network
- Partisan Zmiy Hackers Use Telegram-Controlled Vasilek Backdoor to Spy on Healthcare Networks
- GBHackers: Partisan Zmiy malware campaign
- SC Media: Belarus-aligned group maintains long-term access to Russian healthcare network
- Kaspersky ICS CERT: TTPs of Cyber Partisans activity aimed at espionage and disruption
- Kaspersky ICS CERT report PDF (Cyber Partisans TTPs)
Detection coverage for TL-2026-4406
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4406 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.