Belarus-Aligned Hackers Hid a Backdoor in VMware Tools for 2 Years
Solar 4RAYS says Partisan Zmiy spent about two years in a Russian healthcare network, hiding the Telegram-controlled Vasilek backdoor and a fake service in an unmonitored VMware Tools directory.
A Belarus-aligned hacktivist group spent roughly two years inside a large Russian healthcare organization, hiding its tools in a VMware Tools folder that nobody was watching. Russian security firm Solar 4RAYS attributes the intrusion to Partisan Zmiy, also known as Cyber Partisans, and says the earliest traces date to early 2024. It was only caught in December 2025, when antivirus alerts fired during a scan from a subsidiary’s network. The Hacker News notes that, unlike some of the group’s earlier attacks, nothing was wiped. Solar thinks the access was more useful for spying, since the victim had trusted links to many subsidiary clinics. The victim isn’t named, and initial access is not known.
For defenders
What Solar found: VMware Tools had been installed years earlier but wasn’t used, so its directory went unmonitored. The attackers registered a fake service, vmauad (“VMware Auth Adapter”), that ran an unsigned loader, authd.exe, from that folder. The loader launched a GOST tunnel every Saturday from 22:00 to 23:00 and started the Vasilek backdoor (v1.5.8) once, eight hours after the service started. In December 2025 they also swapped the signed vmtools.dll for an unsigned copy of Vasilek and kept the original as vmtoolsd.dll. Vasilek takes commands over a Telegram group chat and can run commands, steal files, log keystrokes, take screenshots and simulate mouse input. Solar says it also has HTTP(S), DGA and DNS fallbacks, so blocking Telegram is not a fix. Other tools seen: DNSCat2, PartisanDNS, 3proxy, and Impacket-style WMI execution. No CVE is involved.
Easy catch Solar points to: a signature check on trusted software folders would have flagged authd.exe, rpctool32.exe, vmtoolsd32.exe and the swapped vmtools.dll, because none of them are signed.
ATT&CK (per Solar): T1543.003 (Create or Modify System Process: Windows Service), T1574.001 (Hijack Execution Flow: DLL), T1036.004 (Masquerading: Masquerade Task or Service), T1036.005 (Masquerading: Match Legitimate Resource Name or Location), T1070.006 (Indicator Removal: Timestomp), T1480.001 (Execution Guardrails: Environmental Keying), T1047 (Windows Management Instrumentation), T1102.002 (Web Service: Bidirectional Communication), T1071.004 (Application Layer Protocol: DNS), T1568.002 (Dynamic Resolution: Domain Generation Algorithms), T1090 (Proxy). Solar’s table lists the DLL swap under T1574.004; we’ve mapped it to the Windows DLL technique.
Service: vmauad (display name “VMware Auth Adapter”)
Other services: tpvmmon, aweman32, msadcs32, uplay_r164
C:\Program Files\VMware\VMware Tools\authd.exe
C:\Program Files\VMware\VMware Tools\rpctool32.exe
C:\Program Files\VMware\VMware Tools\vmtoolsd32.exe
C:\Program Files\VMware\VMware Tools\vmtoolsd.dll (moved original)5bc4fa9916c0883d45cb85639e328ed484dc75f4dfda294eb52f4b8b612889f2 (authd.exe)
c499fab59acbb1750e1e0e5a3c51d119ccd6374e5f0b45639f29598720222766 (rpctool32.exe)
87e713f9b6ae14d97d3fa4d1a882c029e7e963d844d9c93ea383cab3d46a949c (rpctool32.exe)
d7aedc020ce832334abf0d03986da31f41cb2191355f25b17989dcfa8bb2775b (vmtoolsd32.exe)
125ead2c3b1d0f7aee03d13b927744ec8dc1d046912ce73efc9c5a10243b99dc (vmtools.dll)okkgb[.]com
c-oh[.]com
89e[.]org
parker-inc[.]com
c0ce[.]org
p7cp[.]org
gov-by[.]com
f91j[.]org
w3a01[.]net
vfvnfaq[.]* (PartisanDNS DGA, many TLDs)
vpnosljjk[.]proSolar’s post has the full hash list, including the System32 DLLs.
What it means for you
This was a targeted spying operation against a Russian hospital network, so most readers aren’t in the line of fire. The lesson is broader, though: software you installed once and forgot about is a good hiding place, because nobody checks on it. If you run a small office, uninstall programs you no longer use. If you don’t manage Windows servers, there’s nothing to do here.
Do this now
- Check the digital signatures on everything in
C:\Program Files\VMware\VMware Tools\and other rarely touched vendor folders. An unsigned DLL or EXE in there deserves a closer look. - List Windows services and look for
vmauador VMware-looking names that don’t match your installed VMware Tools version. Check System log Event ID 7045 for new services. - Don’t close out an antivirus alert on a server without investigating it. That’s how this one was finally found.
- Look for Telegram Bot API traffic and unusual DNS volume from servers, and remove VMware Tools from hosts that aren’t VMware guests.