# Vasilek Backdoor Hidden in Trojanized VMware Tools During Two-Year Intrusion at Russian Healthcare Organization (Partisan Zmiy)

> Belarus-aligned hacktivist group Partisan Zmiy (Cyber Partisans) maintained a nearly two-year intrusion in a Russian healthcare organization, persisting through a loader-scheduler service and DLLs masquerading as VMware Tools components. Tooling included the Telegram-controlled Vasilek backdoor (v1.5.8), GOST/3proxy tunnels, DNSCat2 and PartisanDNS; the group also operates the Pryanik wiper and Evlx log-clearing utility.

- **Published:** 2026-10-24T15:52:06Z
- **Last reviewed:** 2026-10-24T15:52:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4406
- **ID:** TL-2026-4406
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Partisan Zmiy (Belarus)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Solar 4RAYS (Rostelecom-Solar) investigated an intrusion at a Russian healthcare organization with extensive infrastructure and trusted relationships with subsidiary medical institutions. Evidence of compromise dates to early 2024; the intrusion was discovered in December 2025 and the Solar report (rt-solar.ru/solar-4rays/blog/7027/) was published in October 2026. The initial access vector is unknown. Observed command execution matched Impacket wmiexec.py (output redirected to \\127.0.0.1\ADMIN$\__<timestamp>.<microseconds>), scanning activity originated from a subsidiary medical organization, and lateral movement used RDP with legitimate credentials and SMB/ADMIN$ command execution.

Persistence relied on a previously undescribed scheduler-loader, authd.exe, installed as the service 'vmauad' (display name 'VMware Auth Adapter') in C:\Program Files\VMware\VMware Tools\. It runs payloads on a cron-like/interval schedule: one GOST tunnel every Saturday 22:00-23:00, and an updated Vasilek (v1.5.8) launched once eight hours after the service starts, to separate malicious traffic from boot activity. Payloads were hidden under VMware/WSUS-like names (rpctool32.exe = Vasilek, vmtoolsd32.exe and E:\WSUS\UpdateServicesPackages\WsusService.exe = GOST); the legitimate vmtools.dll was replaced with an unsigned malicious DLL while the original vmtoolsd.dll was retained. Additional services masqueraded as Windows or third-party components ('Windows Insiders Service' tpvmmon, 'Windows Channels Service' aweman32, 'Sybase Inc. Product File' msadcs32, 'Access FT Imager Service' uplay_r164) and loaded UPX-packed DNSCat2 or the custom PartisanDNS DNS tunnel (with DGA domains). AppMgmt service parameters were temporarily modified for execution, and ConsentPromptBehaviorAdmin was modified under the Policies\System registry key.

Vasilek is a 32-bit Windows backdoor with a 59-entry command table (Vigenere-encrypted), OLLVM control-flow flattening, encrypted strings and dynamically resolved APIs. It is controlled through the Telegram Bot API (getUpdates long polling, group chat with an anonymous group bot), and checks a salted SHA-256 hash of the computer name before running so it only operates on the intended host. Capabilities include command execution via cmd.exe, process creation, file upload/download, screenshots, keylogging, clipboard collection, UAC bypass via runas (cadmin/force_cadmin), suppression of outgoing messages (mute), self-update (update/wget) and removal, and a new move_cursor command that simulates user input. Telegram being blocked by Russian ISPs made the C2 channel unstable, which is why GOST and DNS tunnels were kept as alternates. Other operational-security measures included hostname binding in two independent components, nightly scheduled payload launches, system proxy inheritance, disguise as installed-but-unused software, file rotation across the same paths, time-stomping and outgoing message suppression.

Solar also observed HypeAgent, a previously unreported trojan delivered via JavaScript attachments posing as payment or purchase-order documents, with remote control, webcam, hidden VNC/RDP, crypto-mining, cookie theft from many services and Exodus wallet tampering. Unlike earlier Cyber Partisans operations (Kaspersky ICS CERT, June 2025), the actors did not run destructive tooling during the dwell time; researchers assess the access was retained for espionage and trusted-relationship attacks against connected medical entities. The group's Pryanik wiper is a logic bomb that triggers at preset times and can re-trigger about a month later if not removed. Russia's Supreme Court designated Cyber Partisans an extremist organization in July 2026. No CVE was involved.

## MITRE ATT&CK

- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1059.003 Windows Command Shell
- T1543.003 Windows Service
- T1574.001 DLL
- T1548.002 Bypass User Account Control
- T1480.001 Environmental Keying
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1070.006 Timestomp
- T1027.002 Software Packing
- T1112 Modify Registry
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1113 Screen Capture
- T1056.001 Keylogging
- T1102.002 Bidirectional Communication
- T1071.004 DNS
- T1568.002 Domain Generation Algorithms
- T1090 Proxy

## Sources

- [Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion](https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html)
- [Solar 4RAYS: Partisan Zmiy intrusion at a medical organization](https://rt-solar.ru/solar-4rays/blog/7027/)
- [The Record: Belarusian hacktivists spent two years in Russian healthcare network](https://therecord.media/belarusian-hacktivists-two-years-Russian-healthcare-network)
- [Partisan Zmiy Hackers Use Telegram-Controlled Vasilek Backdoor to Spy on Healthcare Networks](https://cyberpress.org/vasilek-backdoor-targets-healthcare/)
- [GBHackers: Partisan Zmiy malware campaign](https://gbhackers.com/partisan-zmiy-malware/amp/)
- [SC Media: Belarus-aligned group maintains long-term access to Russian healthcare network](https://www.scworld.com/brief/belarus-aligned-group-maintains-long-term-access-to-russian-healthcare-network)
- [Kaspersky ICS CERT: TTPs of Cyber Partisans activity aimed at espionage and disruption](https://ics-cert.kaspersky.com/publications/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/)
- [Kaspersky ICS CERT report PDF (Cyber Partisans TTPs)](https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-TTPs-of-Cyber-Partisans-activity-aimed-at-espionage-and-disruption-En.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4406