Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
Belarus-aligned hacktivists maintained a two-year foothold in a Russian healthcare network by hiding a backdoor inside VMware Tools—underscoring how virtualisation management software can become a persistence blind spot.
Summary written by editorial AI · Source link below
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.
According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.
Known to be active since at least 2020, the group has a track record of striking industrial
Editorial Analysis
The two-year dwell time achieved by hiding in VMware Tools highlights a class of persistence vectors that many enterprises do not monitor, particularly within virtualisation infrastructure.
Implement file-integrity monitoring on VMware Tools and other virtualisation management binaries, and include them in routine compromise assessments.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d