Search — “vmauad”
1 story · 1 IoC
Stories
P3
Cyber Partisans hid Vasilek Telegram backdoor as VMware Tools in Russian healthcare org
brief 2026-10-21CISO cardIoC card (3)deep readLowactor: Cyber Partisans (Partisan Zmiy)malware: Vasilek
Solar reports Belarus-aligned Cyber Partisans (Partisan Zmiy) persisted ~2 years in a Russian healthcare organization using a fake VMware service 'vmauad' that launches a rogue authd.exe in the VMware Tools directory, or a malicious vmtools.dll replacing the legitimate DLL. The loader runs a GOST tunnel every Saturday 22:00-23:00 and Vasilek 1.5.8 eight hours after service start; Vasilek uses Telegram for C2/exfil. The group is also known for DNSCat2, the Pryanik wiper and event-log clearing via Evlx. Hunt for unexpected services/binaries in VMware Tools paths, Telegram API traffic from servers, timestomping and log clearing.
IoCs
| filename | vmauad | seen 1×, first 2026-10-21 13:04Z | Masquerading loader-scheduler service name · 2026-10-21 |