Cybersecurity
Solar links Vasilek backdoor to Russian healthcare breach
Solar said a Belarus-aligned group stayed inside an unnamed Russian healthcare network for nearly two years, hid a Vasilek backdoor in VMware Tools files, and used it for persistence and access.
- Solar said a Belarus-aligned hacktivist group remained inside a Russian healthcare network for nearly two years, and it attributed the activity to Partisan Zmiy, also known as Cyber Partisans.
- Solar said it found the intrusion in December 2025, while the earliest evidence it identified dated to early 2024, and the target organisation was not named.
- The attackers used a service called vmauad and a VMware Tools path to maintain access, and Solar said they ran Vasilek 1.5.8 through authd.exe.
- Solar also described a phishing campaign that delivered HypeAgent, and the article noted a U.S. Justice Department case against Searzhudin Tamirlanovich Aktulaev over malware sent through a freelance platform messaging service.
Solar said a Belarus-aligned group had stayed inside an unnamed Russian healthcare organisation for almost two years. It attributed the activity to Partisan Zmiy, which it said was also known as the Cyber Partisans.
Solar said it discovered the intrusion in December 2025, but the earliest signs it found pointed back to early 2024. The firm said the attackers did not carry out destructive actions during that period and may have valued the access for espionage and related attacks.
The report said the intruders used a loader-scheduler service called vmauad that pretended to be part of VMware. Solar said they abused a trusted VMware Tools location to plant files or swap in a malicious vmtools.dll, and that authd.exe launched a GOST tunnel and then ran Vasilek 1.5.8.
Solar said Vasilek could gather information from the host, run commands, manage processes, transfer files, take screenshots, log keystrokes, and change privileges through runas. It also said the backdoor could stop the machine sleeping, update itself, remove itself, and use a new move_cursor command to imitate user input.
In the same set of disclosures, Solar said a phishing campaign used JavaScript attachments to deliver HypeAgent. The article also said the U.S. Department of Justice charged Searzhudin Tamirlanovich Aktulaev over malware-laden attachments sent through a freelance platform's messaging system.
Named in this story
People
- Searzhudin Tamirlanovich Aktulaev
- was charged over the malware attachment scheme
Companies
- Solar
- published the report and attributed the intrusion
Organisations
- Partisan Zmiy
- was the threat cluster Solar blamed for the activity
- Cyber Partisans
- was the alternate name used for Partisan Zmiy
Governments and agencies
- U.S. Department of Justice
- charged Searzhudin Tamirlanovich Aktulaev
Products and systems
- VMware Tools
- was the trusted directory path the attackers abused
- Vasilek
- was the backdoor used for command and control
- vmauad
- was the service that masqueraded as a VMware component
- FortiClient VPN
- was installed alongside DNSCat2 in some attacks
- DNSCat2
- helped the attackers control infected hosts
- Pryanik
- was the wiper linked to destructive attacks
- Evlx
- was used to clear Windows event logs
- HypeAgent
- was the trojan delivered by the phishing campaign
Places
- Cyprus
- was where Aktulaev was extradited from
- Russia
- was where the healthcare network and other targets were based
- Belarus
- was the state associated with the group's alignment
How the source tells it
The piece read as a technical incident report with a mostly neutral register and little overt emotive framing.
No emotive framing was found in the original.