Partisan Zmiy, Cyber Partisans tied to healthcare backdoor hidden via VMware Tools

En bref

• One healthcare organization was compromised for close to 24 months.
• Partisan Zmiy and Cyber Partisans are the attributed actors.
• Attackers used VMware Tools to help conceal a Vasilek backdoor.
• Solar and VMware are the vendors named in the activity.
• No CVE was cited for this campaign.

Investigators have tied a long-running intrusion at a single healthcare organization to two tracked groups, Partisan Zmiy and Cyber Partisans. The operation began in 2020 and persisted for roughly two years, giving the attackers an extended presence inside the provider's network.

At the center of the incident is a Vasilek backdoor that the intruders worked to keep out of sight. They also abused VMware Tools, a legitimate utility from VMware, as part of the intrusion chain. Solar is named among the vendors connected to the activity. No CVE identifiers were associated with the campaign, so signature-only or patch-centric defenses would not have been sufficient on their own.

The affected scope appears limited to one healthcare entity, but the duration matters. A backdoor that stays hidden for nearly two years can support repeated access, credential theft, and lateral movement. Healthcare environments hold sensitive patient data and support critical operations, so prolonged unauthorized access raises both privacy and service-continuity concerns.

The attribution to Partisan Zmiy and Cyber Partisans places the activity in a broader pattern of politically or ideologically motivated cyber operations, though the facts do not establish motive here. The use of VMware Tools shows how ordinary administrative software can blend into normal network traffic and complicate detection.

Defenders should watch for unusual VMware Tools execution, unexplained persistence, and long-dormant accounts or scheduled tasks. Reviewing logs from 2020 onward, validating endpoint telemetry, and hunting for Vasilek indicators are priorities. Because no CVE was cited, behavior-based monitoring and asset visibility matter more than waiting for a patch.

À faire maintenant

1. Hunt for Vasilek backdoor indicators and unusual VMware Tools child processes across endpoints and servers; isolate confirmed hosts.
2. Review authentication, VPN, and remote-access logs back to 2020 for anomalous sessions, then reset credentials and revoke stale tokens.
3. Baseline legitimate VMware Tools parent-child process behavior and alert on command execution or file drops through that utility.
4. Deploy behavioral EDR rules for persistence mechanisms, scheduled tasks, services, and long-dormant accounts rather than relying on CVE signatures.
5. Segment the healthcare network, limit lateral movement, and enforce least privilege plus MFA for administrative access.
6. Preserve forensic evidence and coordinate with incident response and legal teams on healthcare breach notification requirements.
7. Inventory and patch Solar and VMware products as hygiene, but treat that work as secondary to behavior-based detection.

Source originale

The Hacker News