Hackers Hid Vasilek Backdoor in VMware Tools
The two-year intrusion compromised a medical organization by replacing legitimate system libraries.
Updated on Oct. 7, 2026 in Cybersecurity
Live Poll
Do you trust that local medical providers are effectively securing your digital health information?
Beginning in early 2024, attackers from the group Partisan Zmiy maintained unauthorized system access for two years by embedding the Vasilek backdoor within a VMware Tools installation. Researchers uncovered the compromise in December 2025 after identifying an updated build of the malware.
Why it matters
The breach highlights the risks of supply-chain-style manipulation where attackers replace trusted system files to facilitate long-term espionage within medical networks. By preserving original libraries, the group minimized signs of tampering, complicating detection efforts.
The 32-bit Vasilek version 1.5.8 backdoor features a 59-entry command table for functions ranging from keystroke logging to file transfers. It communicates via the Telegram Bot API and secondary channels, including DNSCat2 and a specialized GOST tunnel operating on Saturdays.
The players
Partisan Zmiy
An advanced persistent threat group focused on espionage through stealthy backdoor deployment.
The details
Attackers bypassed security checks by replacing a genuine VMware library with a malicious version, omitting a valid digital signature. To maintain persistence, the operators utilized an undocumented loader and assigned it a plausible Windows service display name. The backdoor uses a complex communication stack, including the PartisanDNS protocol and a GOST-plus-3proxy tunnel, with the latter restricted to an operational window between 10 p.m. and 11 p.m.
Timeline
Early 2024: Earliest evidence of the intrusion detected.
Every Saturday: GOST tunnel operation window.
December 2025: Researchers identified an updated Vasilek build and loader.
The Tech Race
The breach mirrors the methods used in the SolarWinds supply-chain attack by replacing trusted software components to gain persistent, long-term access. This incident serves as a reminder of the industry-wide challenge in verifying the integrity of system-level utilities in complex environments.
Security administrators managing VMware environments should audit existing installation directories for non-signed or renamed library files. This incident underscores the necessity of monitoring system service lists for undocumented entries that mimic legitimate vendor names.
The takeaway
The Vasilek case demonstrates that attackers can bypass traditional security by hiding within standard system tools. Security teams should cross-reference existing library signatures against known vendor hashes to identify similar unauthorized modifications.
Further reading
For more on evolving threat vectors, visit our section on Cybersecurity.
Live Poll
Do you trust that local medical providers are effectively securing your digital health information?
