Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group, known as Partisan Zmiy or the Cyber Partisans, spent almost two years inside a Russian healthcare organization's network. The group, active since at least 2020, has a history of targeting industrial entities. They were able to hide a backdoor, called Vasilek, in VMware tools during the intrusion. The incident was uncovered by Russian cybersecurity firm Solar, which attributed the activity to this threat cluster. The group's actions suggest a focused effort on compromising specific sectors. The long duration of the intrusion indicates a significant level of stealth and evasion by the attackers.