Hacktivists Hid Inside a Russian Healthcare Network for Nearly Two Years by Posing as VMware Software

A report from Russian cybersecurity firm Solar describes a long-running intrusion into a Russian healthcare organisation by a group tracked as Partisan Zmiy, also known as the Cyber Partisans. The group is Belarus-aligned, has been active since at least 2020, and has previously targeted industrial enterprises and government agencies in Russia and Belarus. Solar found the intrusion in December 2025, but evidence suggests the first signs of compromise date back to early 2024. The victim was not named, and how the attackers first got in is not known.

The group is known for a backdoor called Vasilek, which uses Telegram to receive commands and send out stolen data. It has also used a wiper called Pryanik for destructive attacks and a utility to clear Windows event logs. In this case, however, the attackers did not destroy anything. Solar suggests the victim's extensive infrastructure and trusted links with many subsidiary medical institutions made the access more valuable for espionage and further attacks through those relationships.

To stay hidden, the attackers used a service named "vmauad" that posed as a legitimate VMware component. They took advantage of a trusted but unmonitored VMware Tools directory, planting malicious files or replacing a genuine VMware library with a malicious version containing the backdoor.