Belarus-aligned hackers hid Vasilek backdoor in VMware Tools for two years

A Belarus-aligned hacktivist group spent nearly two years inside the network of a Russian healthcare organization, hiding a Telegram-controlled backdoor called Vasilek inside the VMware Tools directory, according to an investigation by Russian security firm Solar 4RAYS. The findings, reported by The Hacker News on October 21, show how attackers abused a trusted but rarely monitored software folder to evade detection.

What happened

Solar 4RAYS, a unit of Rostelecom subsidiary Solar, said it was called in in December 2025 after a scan of the client's domain was traced to the network of a subsidiary. The earliest traces of compromise in the investigated infrastructure date back to early 2024. The victim, which Solar did not name, was described as a large medical organization with two-way trust relationships with numerous subsidiary institutions.

The firm attributed the activity to Partisan Zmiy, also known as the Cyber Partisans, citing shared infrastructure, tactics and the use of Vasilek, which it said had previously appeared only in this group's operations. Unlike some earlier Cyber Partisans attacks, no destructive activity was observed; Solar suggested the access was more valuable for espionage and for attacks on trusted partners. The initial access vector remains unknown, The Hacker News noted.

Technical details

According to Solar 4RAYS, the attackers replaced the legitimate vmtools.dll in the VMware Tools folder with an unsigned copy containing Vasilek, keeping the original under another name for rollback. A custom loader, authd.exe, ran as a fake "VMware Auth Adapter" service named vmauad and launched a GOST proxy tunnel every Saturday between 22:00 and 23:00, plus Vasilek on a delayed one-time schedule.

Vasilek version 1.5.8 receives commands from and sends data to a Telegram group via the Bot API. Solar counted 59 commands, including command execution, file transfer, screenshots, keylogging, simulated input and privilege escalation. The backdoor checks a salted hash of the hostname and exits silently on other machines, which hinders sandbox analysis. The group also used DNSCat2, a DNS tunnelling tool dubbed PartisanDNS, GOST and 3proxy, and moved laterally over RDP and SMB. File timestamps were altered to match genuine VMware Tools files.

Who is affected

The Cyber Partisans have previously targeted industrial enterprises and government agencies in Russia and Belarus. The persistence techniques, however, are relevant to any organization running virtualized Windows hosts, since vendor directories such as VMware Tools are often trusted by default.

What to do

Solar recommends verifying the digital signatures of files in trusted software directories, auditing services that load executables or DLLs from System32 and vendor folders, reviewing service installation events (Event ID 7045) and unexpected changes to service registry keys such as AppMgmt. Defenders should also monitor for Telegram Bot API traffic from non-browser processes and unusual TLS fingerprints, and look for Impacket-style command output written to ADMIN$. Solar's report lists hashes, service names such as vmauad, tpvmmon and msadcs32, and domains including gov-by[.]com for hunting.