Critical VMware Tools Flaw Lets Attackers Install Vasilek Backdoor

Key Takeaways

• A sophisticated threat actor has been observed embedding the Vasilek backdoor within legitimate VMware Tools installations.
• The attack chain targeted a medical organization, maintaining persistence for approximately two years and exposing sensitive data.
• The attackers leveraged trusted software directories and disguised malicious components with names mimicking genuine virtualization software.
• The Vasilek backdoor, controlled via Telegram, provides extensive surveillance and control capabilities, including command execution, file transfer, and keystroke logging.
• No specific vulnerability in VMware Tools was exploited; instead, the existing installation was abused as a stealthy hiding place.

Cybersecurity researchers have uncovered a persistent campaign where attackers integrated the Vasilek backdoor into a medical organization’s VMware Tools installation, maintaining covert access for around two years. This prolonged intrusion, dating back to early 2024, focused on espionage and data exfiltration rather than disruptive attacks, exploiting trust relationships with numerous affiliated medical institutions.

Investigators from Solar 4RAYS, who initiated their probe in December 2025, identified an updated variant of Vasilek and a previously unknown custom loader. Evidence points to initial remote command execution, followed by lateral movement using legitimate remote desktop and Windows file-sharing services. While the initial compromise vector remains unconfirmed, Solar’s analysis, detailed in a report shared with Cyber Security News (CSN), suggests a link to the threat group known as Partisan Zmiy due to overlapping infrastructure and tactics.

The attackers exploited the organization’s extensive network of subsidiary medical institutions, likely using this access for intelligence gathering across connected entities. This incident underscores a growing trend of threat actors camouflaging malicious activities within common software and network services, particularly when targeting the healthcare sector.

Stealthy Integration within VMware Tools

The attackers did not exploit a vulnerability within VMware Tools itself. Instead, they leveraged an existing, legitimate installation of VMware Tools that was present but unused by administrators. This provided a trusted, yet unmonitored, location to deploy their malicious components. These components were deliberately named to resemble authentic virtualization software, further aiding their concealment.

Before their discovery in December 2025, the attackers replaced a legitimate VMware library with their malicious code, carefully preserving the original file under a different name—a tactic likely intended for potential restoration or to avoid immediate detection. Unlike the genuine library, the substituted malicious file lacked a digital signature. Solar described this library substitution as a key mechanism for maintaining persistent access.

This method of hiding malware within familiar software directories is consistent with other backdoor research, highlighting a broader adversary trend of blending into the legitimate operational environment. Furthermore, the attackers created Windows services with innocuous display names, ensuring their malicious libraries and custom loader appeared as routine entries in service listings.

The custom loader was configured to execute its tools on a fixed schedule. For instance, a GOST tunnel activated every Saturday evening from 10 p.m. to 11 p.m., while another tunnel and the Vasilek backdoor launched once, eight hours after the service started. Researchers interpret this limited operational window as a potential backup communication channel. Further evidence of concealment included the alteration of file timestamps to match legitimate VMware components and the reuse of file paths for different malicious tools. The loader’s configuration also referenced a server-specific Windows update repository, indicating that deployment followed meticulous reconnaissance rather than generic settings.

Vasilek Backdoor: Telegram Control and Detection Challenges

Vasilek, a 32-bit Windows backdoor first publicly documented in 2025, was analyzed by Solar in version 1.5.8. This variant features a comprehensive command table with 59 entries, including aliases, enabling a wide array of malicious actions. Its capabilities encompass remote command execution, file transfers, keystroke logging, screenshot capture, clipboard content collection, and mouse input manipulation.

Operators controlled Vasilek through a Telegram group, utilizing the public Bot API. They posted commands anonymously on behalf of the group, and the malware returned results to the same chat, further obscuring their identities. The backdoor’s connections were routed through corporate proxy settings, allowing them to blend with legitimate network traffic.

Telegram was not the sole command-and-control channel. The attackers also employed DNSCat2, PartisanDNS, and a GOST-plus-3proxy chain, ensuring multiple redundant access points. This multi-channel approach means blocking a single service would be insufficient to disrupt their operations. The use of DNS tunneling for C2 traffic highlights how attackers can hide malicious communications within ordinary network activity, though these campaigns are not necessarily linked.

To thwart analysis, the Vasilek backdoor verified the infected computer’s name before activating. Solar recommends that organizations go beyond basic antivirus deployment, emphasizing the importance of verifying digital signatures in trusted software directories and thoroughly investigating any antivirus alerts. Incident responders should actively search for additional tunnels, proxy chains, lateral movement tools, and any delayed destructive payloads. Crucially, security logs proved invaluable, preserving service creation events and traces of remote command execution, allowing investigators to reconstruct parts of the intrusion even after attackers had modified files and settings.

The following Indicators of Compromise (IoCs) are provided with their exact values from the source. It is important to note that while Solar’s narrative associates the substituted VMware library with Vasilek, its detailed indicator appendix identifies that particular sample as loading PartisanDNS. Both descriptions are included for accuracy; shared hosting addresses and legitimate artifacts necessitate careful contextual interpretation.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM. Additional detailed indicators of compromise, including a comprehensive list of hashes, can be found in the <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/1af140e0-99ca-421b-b7bb-b5d18d5eb35f/Hackers-Hide-Vasilek-Backdoor-Inside-VMware-Tools-to-Target-Medical-Organizations.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Checksum-Mode=ENABLED&X-Amz-Credential=ASIA2F3EMEYETRCBKM73%2F20261007%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20261007T072557Z&X-Amz-Expires=1521&X-Amz-Security-Token=IQoJb3JpZ2luX2VjED8aCXVzLWVhc3QtMSJHMEUCICnHhPYHX%2FrqXPrlgAPkBOmEpksLDy3rrz21puwo%2Ff5RAiEA7ge2sSD8It5kctz4U%2FndxR7oHEvof7KZf4XD4tcWFJgqgAUIBxABGgw2OTk3NTMzMDk3MDUiDPeLTO9PAoZqXnS9LirdBMFl6S5dan39HMk2LbrkRyXUz3JUqnxFyW%2BvMHgonYWE3nEqn74yvvtTDvmWQPj8RL9sZWeJFpoxok%2FYHc2rW8vxWAMB3lgKgxUBroOh1PnJHSNiVAwGTI6T%2Ft84NE5BiqMyuuposJXITBX7jEXNwOpD2gbd3NO3HFP7N1yIO%2BEp9tEwy6khBWfxoM3a7MQ9pdPWXdta8cDh1xxpUsk5udUVu9%2BV5VnspoprHvMs1aD5n457xiVRVSIYwl7nGLIfqK8MaMR0kLZ9oeo6PHD%2BoUTGQGfpY95nXu5f99bO%2F0uHX%2BBm0FGq77BGDSnjJlj1XlxrBmQqAfcHVCZbF57gas5ev%2BvEfiYeX9M%2FPuyqgH%2FlyrXCs7uh%2BBlHqxbk4drU2k1yQBtFF3uRM%2BQwHJaXYTffPZdYWDz%2FMBkb%2FZd37hKlVFBLBmlWxR3Jbc%2F2dp4XjiOr4zKzS6VjohEGwJtJKEUW%2FaNdjN%2BOes%2FJBjObn2ywbsRORvOWnXfZxJA2ysH5aZvH%2B%2BGpos8pnL0M9eVDxBDW3SOPQhnm1uHC4MkLMJ2GOI1whX7zAGJoAwTGlxBWtHT0cjloSL%2F%2FbnK4S6F3rXAn7h%2BoQVA4jFRiMXbPOjD2aqevYqNuEHSU2NT%2BxOKJXZbQ%2BI2fUip010%2FGktujNZQkMP%2FuR4Bi1JsdkXSUkNm79byfVCYQQz%2Fqud9XbpKqeZm4qdIuV4HySGhVBdp%2BrXiQrS8pYdeFKDOZjXU7AUmU17WB%2FGgLf3CZrtYWDWgb0pGMJ0Tx3rs4jsqh4oqVKpEBWmdCgnSYHhe5V838MKPYl9YGOpgB8A8LsAy95Ix5pJRS%2BKFsl54cSoI7Ofr4l6ofAIiOz49dvUxOirWW5hQ26g3v7IoH9p4s2zi9A01JwDT2RK17k51GKFPQV3oP3iy8SNAedLvD5w2zABCP%2Bplou

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.