Attackers Hide Vasilek Backdoor in VMware Tools for Trusted Persistence During Two-Year Russian Healthcare Intrusion
An analysis published by Russian cybersecurity firm Solar and reported by The Hacker News in October 2026 says attackers buried a backdoor known as Vasilek inside VMware Tools to maintain a foothold in a Russian healthcare organisation's network for nearly two years. For vSphere administrators, the headline is less about who carried out the intrusion than how they stayed: when a malicious implant lives inside a guest-agent component that operators install deliberately and whitelist by policy, the defender's question shifts from "should this file exist here?" to "does this file match our golden image bit for bit?"
Abuse of a trusted component
Solar attributes the intrusion to a threat cluster called Partisan Zmiy (also known as Cyber Partisans), a Belarus-aligned hacktivist group active since at least 2020 with a track record of targeting industrial facilities. The attribution remains a single-vendor judgment with limited independent corroboration.
The tradecraft is the story. Public material does not establish whether Vasilek is a bespoke tool built for this group or a commodity backdoor in general circulation. Either way, mounting a payload on a privileged guest-agent that administrators treat as an implicit trust anchor moves the detection burden away from signature scanning and toward image-integrity verification and file-source allowlisting. Defenders who rely on hash matching and behavioural signatures will find that an implant "living inside a legitimate management tool" sails through routine checks.
A dwell time of nearly two years is equally troubling. Dwell times of this length usually point to hygiene gaps rather than novel vulnerabilities: log retention too short to surface the intrusion, anomalous access never reviewed, lateral movement with no detection coverage, and no baselining of guest-agent versions or content changes. Whether data was exfiltrated is not established by the public material, and this article makes no such claim. Solar's IOC indicators have not been published in the reporting available so far.
Implications for vSphere and healthcare virtualisation teams
The exposure is jurisdiction-neutral: any organisation running vSphere or a comparable platform treats a privileged guest agent as part of its trust foundation. That makes this a concrete review item for Hong Kong IT teams, particularly in healthcare and public services where virtualisation underpins core systems. Healthcare virtualisation estates tend to have disciplined change management, yet the "management tooling is untouchable" mindset can leave guest-side integrity checks unexamined for years.
The post-acquisition licence and support changes at Broadcom have already pushed many organisations to take stock of their virtual infrastructure. That inventory exercise is a natural moment to fold in Guest Tools version, installation baseline, and signing origin: confirm the Tools package is vendor-signed, enable installation verification, document exceptions, and fold guest-agent hash monitoring into routine operations — all considerably cheaper than post-incident forensics.
This report is based on what The Hacker News has publicly disclosed. Solar's IOC indicators, the exact intrusion timeline, and victim details remain unavailable in the material at hand. For defenders, the action items are clear enough regardless: inventory what has been installed on your virtual machines — and confirm anyone is actually checking.
攻擊者在 VMware Tools 藏入 Vasilek 後門，於俄羅斯醫療機構長達兩年的入侵期間達成受信任持久化
俄羅斯網絡安全公司 Solar 發布、並由 The Hacker News 於 2026 年 10 月報導的一份分析指出，攻擊者把一個名為 Vasilek 的後門埋入 VMware Tools 之內，在一家俄羅斯醫療機構的網絡中維持立足點近兩年。對 vSphere 管理員而言，這則消息的重點與其說是誰策動了這次入侵，不如說是他們如何潛伏：當惡意植入程式寄生在管理員按政策主動安裝並列入白名單的客體機代理元件之內，防禦者的判斷問題便由「這份檔案應不應該存在於此」變成「這份檔案是否與我們的黃金映像逐位元相符」。
濫用受信任元件
Solar 將此次入侵歸因於一個名為 Partisan Zmiy（又稱 Cyber Partisans）的威脅集群，這是一個白俄羅斯關聯的 hacktivist 團體，至少自 2020 年起活躍，過往目標涵蓋工業設施。該歸因仍屬單一廠商判斷，獨立佐證有限。
手法本身才是重點。公開資料未能確定 Vasilek 究竟是為該組織專門打造的工具，還是在外流通的 commodity 後門。無論如何，把攻擊負載掛載到管理員視為隱性信任錨點的高權限客體機代理程式上，等於把偵測責任從簽章掃描轉移到映像完整性驗證與檔案來源允許清單（allowlisting）。只依賴雜湊比對與行為簽章的防禦者會發現，這種「寄居於正規管理工具」的植入程式輕易便能通過例行檢查。
近兩年的停留時間同樣值得警惕。這類長度的 dwell time 通常指向基礎衛生問題，而非新穎漏洞：日誌保存期限太短，未能浮現入侵跡象；異常存取從未覆核；橫向移動缺乏偵測覆蓋；guest agent 版本與內容變更亦沒有基線管理。數據是否遭外洩，公開資料並未證實，本文亦不作此宣稱。Solar 的 IOC 指標則尚未在目前可得的報導中公開。
對 vSphere 及醫療虛擬化團隊的啟示
相關風險在轄區上是中性的：任何運行 vSphere 或同類平台的機構，本質上都把高權限 guest agent 當作信任基礎的一部分。這使其成為香港 IT 團隊一個具體的檢視項目——尤其是在醫療與公共服務領域，虛擬化正是核心系統的承載基礎。醫療虛擬化環境通常有較嚴謹的變更管理，然而「管理工具不可動」的心態，往往令 guest 端的完整性核對長年無人過問。
Broadcom 收購後的授權與支援條款變化，已促使不少機構重新盤點其虛擬基建。這類盤點正是順手納入 Guest Tools 版本、安裝基準與簽發來源的契機：確認 Tools 套件由廠商簽發、啟用安裝驗證、記錄例外情況，並把 guest agent 的雜湊監控融入日常作業——成本遠低於事後的入侵取證。
本報導依據 The Hacker News 已公開披露的內容撰寫。Solar 的 IOC 指標、確切入侵時間軸及受害機構詳情，在現有資料中仍未可知。對防禦者而言，可先行採取的行動項目相當明確：盤點你的虛擬機上安裝了甚麼——並確認是否真的有人在查核。