Medium Monitor
Hackers hid backdoor in VMware Tools during two-year Russian healthcare intrusion
The Hacker NewsVMware · healthcare
What happened. A Belarus-aligned hacktivist group, Partisan Zmiy (Cyber Partisans), spent nearly two years in a Russian healthcare organisation's network, according to Solar. The headline says it hid a backdoor called Vasilek in VMware Tools.
Who is affected. A Russian healthcare organisation using VMware Tools. The report says the group has struck industrial targets, but the detail is cut off.
What to do. Check whether you run VMware Tools and review those systems against the Vasilek backdoor details in Solar's report.
Editor's reading
Fordetection engineerIT security
- Are you exposed?
Review virtual machines running VMware Tools for modified components or unknown outbound connections, using Solar's published indicators.
- Watch for
- Unexpected changes to VMware Tools files or processes on virtual machines.
- Indicators for the Vasilek backdoor listed in Solar's report.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
More on Healthcare