A Belarus-aligned hacktivist group, known as Partisan Zmiy or Cyber Partisans, infiltrated a Russian healthcare organization's network for nearly two years using a backdoor called Vasilek.
The vulnerability or weakness
The attackers used a loader-scheduler service ('vmauad') that masqueraded as a legitimate VMware component to maintain persistence. They planted malicious executables or replaced legitimate VMware DLLs with a malicious version ('vmtools.dll').
Earlier attacks and coverage
Business impact
The extended presence without destructive actions suggests the attackers aimed to gather intelligence and maintain a trusted relationship for future operations, potentially impacting the organization’s data security and operational integrity.
Industries affected
Healthcare organizations, particularly those in Russia and Belarus, are at risk.
Users affected
Healthcare staff and patients may be indirectly affected by the potential misuse of sensitive information.
Build these skills
Sources
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion (The Hacker News)
