BELARUS-ALIGNED threat group Cyber Partisans reportedly spent almost two years inside a Russian healthcare organisation’s network, in a campaign attributed by Solar to its Partisan Zmiy cluster. The operation, which appears to have begun at least as far back as 2024 and was uncovered by Rostelecom’s subsidiary in December 2025, was notable for its persistence and espionage focus rather than immediate destruction.
The attackers used a loader-scheduler service named “vmauad” that impersonates a legitimate VMware component to maintain a foothold, exploiting a trusted VMware Tools directory location to plant malicious executables or replace genuine VMware DLLs with a rogue one (vmtools[.]dll). This resulted in the backdoor being launched via a Windows service that starts authd[.]exe, embedded in VMware Tools, and eight hours after the service begins the backdoor runs an updated Vasilek (v1.5.8) on the infected host.
Vasilek, a long-standing backdoor used by Cyber Partisans, provides extensive capabilities including information collection, command execution, process manipulation, file transfer, screenshots, keystroke logging, privilege escalation, and even preventing sleep mode. It also supports covert data exfiltration and, uniquely, a new “move_cursor” command to simulate user input. The malware previously relied on Telegram for C2, though Telegram access in Russia has complicated communications.
The loader’s scheduled payloads, host binding, and stealth measures—such as log clearing and disguise as legitimate software—underscore a patient espionage operation. In addition to Vasilek, the group has dual-use tooling and a willingness to leverage phishing to deploy components like DNSCat2, while maintaining a relatively unchanged feature set across revisions. The public disclosure underscores a shift toward protracted espionage over rapid, disruptive attacks.