Two Years. TWO YEARS. The Wolves Were Just Living There.

Okay. I need you to understand something. I have been awake since yesterday. My coffee tastes like printer toner. I have forty-seven unresolved tickets in the queue. And I just read that a threat cluster called Partisan Zmiy spent nearly two years grazing freely inside a Russian healthcare network before anyone noticed.

Two years. I've had houseplants that died faster and I missed those.

The wolves in question are Belarus-aligned, go by "Cyber Partisans," and have been actively hunting since at least 2020. These are not script kiddies. These are patient, organized, and apparently very comfortable. They hid a backdoor called Vasilek inside VMware Tools. VMware Tools. The thing that's supposed to be helping you. Tucked a parasite right into the infrastructure plumbing and then just... stayed. Made themselves at home. Probably had a favorite chair.

The Russian cybersecurity firm Solar is the one who finally found them, which, good job Solar, but also: two years. The flock had no idea. The shepherds presumably had no idea. Everyone was just out there chewing grass while the wolves had a full residential lease on the server room.

This is the part that keeps me from sleeping, and not just because I already wasn't sleeping. A well-placed tick inside a virtualization management layer is nearly invisible if nobody is actively hunting for it. You're not going to catch this with a quarterly scan and a prayer. Partisan Zmiy clearly knew exactly where to hide and exactly how long they could stay quiet.

The hole in the fence here was likely initial access through a known vulnerability, followed by lateral movement so slow and deliberate that it blended into normal traffic. That's the whole game now. It's not smash and grab. It's move in, unpack, set up a forwarding address.

Healthcare networks are soft targets. Legacy systems, overworked staff, and shepherds who think "we're not interesting enough to attack" is a security strategy. It is not a security strategy. It is a wish.

Remediation

Look, I'm tired, but here's the short version:

• Hunt for implants in your virtualization layer. VMware Tools, agents, anything touching the hypervisor. Assume it's compromised until proven otherwise.
• Behavioral detection matters more than signatures here. If your monitoring only catches known-bad, you will miss this every time.
• Shear your systems regularly. Patch VMware and related tooling like your job depends on it, because it does.
• Log everything. Review the logs. I know. I know. Do it anyway.
• Segment your network so a wolf in one pasture can't wander into all of them.

Two years. I need to lie down.

Original Report: https://thehackernews.com/2026/10/hackers-hid-vasilek-backdoor-in-vmware.html