Ethical Hacking News
A Russian healthcare organization was breached by hackers affiliated with Belarus over a two-year period, who hid a backdoor in VMware Tools to gain persistence. The attackers stole sensitive information, deployed cryptocurrency miners, and evaded detection by leveraging stealth and operational security. This case highlights the evolving nature of cyber threats and the importance of maintaining robust security measures.
The Cyber Partisans, a group of hackers from Belarus, breached the network of a Russian healthcare organization over a two-year period.The hackers hid a backdoor in the VMware Tools, allowing them to maintain persistence and evade detection.The backdoor, called Vasilek, has features that enable the hackers to collect information, execute commands, and transfer files.The group consistently invests in stealth and operational security, rather than new capabilities.The attack on the healthcare organization is attributed to Partisan Zmiy, a threat cluster known for striking industrial enterprises and government agencies.The attackers also used phishing lures to deliver additional malware and staged destructive attacks using a wiper and utility to clear Windows event logs.A previously unreported malware family, HypeAgent, was discovered by Solar, a Russian cybersecurity firm.HypeAgent is a full-featured Trojan designed to take complete control over infected systems, including stealing files and webcam access.
The realm of cybersecurity is replete with tales of wits and cunning, where the adversaries in question employ a plethora of tactics to gain the upper hand. A recent case in point involves a group of hackers known to be affiliated with Belarus, who embarked upon a two-year-long operation to breach the network of a Russian healthcare organization. The hackers, referred to as the Cyber Partisans, successfully managed to hide a backdoor in the VMware Tools, thereby allowing them to maintain persistence and evade detection.
The VMware Tools in question is a legitimate software suite used for automating various tasks related to virtual machines. However, the hackers took advantage of a trusted-but-unmonitored VMware Tools directory location to plant malicious executables or replace legitimate VMware DLLs with a malicious version containing the backdoor. The primary responsibility of the Windows service was to launch the rogue binary "C:\Program Files\VMware\VMware Tools\authd.exe" that, besides launching a GOST tunnel every Saturday from 10 p.m. to 11 p.m., ran an updated version of Vasilek (version 1.5.8) once, eight hours after the service begins.
The Vasilek backdoor is equipped with a plethora of features that enable the hackers to collect information about an infected computer, execute Windows commands, launch and terminate processes, transfer files, capture screenshots, record keystrokes, and escalate privileges via runas. One new addition to the backdoor is the "move_cursor" command that allows the hackers to move the cursor and simulate user input on the victim's screen. The group consistently invests in stealth and operational security, rather than new capabilities.
The Solar, a Russian cybersecurity firm, discovered the intrusion in December 2025, although evidence suggests that the earliest signs of compromise date back to early 2024. The exact initial access vector used to breach the entity is also not known. Unlike other attacks linked to Cyber Partisans, the threat actors remained on the network for an extended period of time without carrying out any destructive activity, marking something of a shift in modus operandi.
The attack on the healthcare organization is attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. The group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with the backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration.
Furthermore, the attackers have also leveraged phishing lures to deliver an installer that simultaneously deploys the legitimate FortiClient VPN program on the system as well as an open-source program known as DNSCat2 that allows attackers to gain control of the infected host. The attackers have also staged destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.
The Rostelecom subsidiary said it discovered the intrusion in December 2025, although evidence suggests that the earliest signs of compromise date back to early 2024. The name of the targeted organization was not identified. The exact initial access vector used to breach the entity is also not known.
Unlike other attacks linked to Cyber Partisans, the threat actors remained on the network for an extended period of time without carrying out any destructive activity, marking something of a shift in modus operandi. The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions. The Solar firm hypothesized that the lack of infrastructure disruption is due precisely to the value of this access for further espionage and trusted relationship attacks.
The disclosure comes as Solar also disclosed details of a phishing campaign that employs JavaScript attachments mimicking business-themed documents, such as payments and purchase orders, to deliver a previously unreported malware family known as HypeAgent. The Windows malware is a full-featured trojan designed to take complete control over infected systems, packing the ability to steal files, open a console, change desktop wallpaper, turn on a webcam, log keystrokes, launch hidden VNC and RDP sessions, control the mouse, and even deploy a cryptocurrency miner.
It's also capable of stealing cookies associated with Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, and Cursor, and tampering with the installed Exodus wallet app to inject JavaScript that can collect the victim's password, PIN, mnemonic phrase, and private key. Earlier this June, Solar also observed legitimate infrastructure compromised by the ProxyCB proxyware botnet malware making automated requests to Russian websites and online platforms, while identifying possible overlaps between the botnet infrastructure and historical activity linked to TeamSpy, a threat cluster known for abusing TeamViewer to facilitate reconnaissance and data theft.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Subtle-yet-Effective-Exploitation-of-VMware-Tools-in-a-2-Year-Russian-Healthcare-Intrusion-ehn.shtml
https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html
Published: Wed Oct 21 03:11:48 2026 by llama3.2 3B Q4_K_M
