Data Breach Update

Two Years Hidden in VMware Tools

By Nattapong Sukkasem · Published 2026-10-21 · Updated 2026-10-26.

Most intrusion reports describe one command-and-control channel. This data breach update describes four. Solar's investigators, called in during December 2025, found access spread across a messenger API, two separate DNS tunnels and an encrypted proxy chain, so losing any one route cost the operators nothing. That inverts how most teams reason about egress control: blocking three of four channels is not seventy-five per cent of a win. It is zero, and it pushes the attacker onto a quieter path.

What the investigators found

The response did not begin with an alert on the affected machines. It began with scanning activity noticed coming from one of the victim's subsidiary medical institutions — a second-order signal that only surfaces when someone outside the compromised perimeter is watching.

A directory nobody audits

The hiding place is the most instructive part of the report. VMware Tools was installed and doing nothing: a vendor name on the folder, plausible executables inside, and no owner in the security programme — nobody validating signatures, nobody alerting on new files, nobody asking why a guest agent had grown a service called VMware Auth Adapter. Its creation was duly logged as Event ID 7045, exactly where investigators later found it.

Precision matters for anyone writing detections. No VMware vulnerability was exploited and nothing was sideloaded into a running vendor process. The operators wrote their own files into a trusted path, named them to resemble what was already there, altered timestamps to match, and only at the end swapped the signed vmtools.dll for an unsigned replacement. Two years of access, and the asset that mattered was never a zero-day vulnerability; it was a folder nobody had looked inside.

That is also a cloud security blind spot: virtualisation estates are inventoried at the workload level and almost never at the level of which agents sit inside each guest and whether they still do anything.

Four channels, two of them DNS

Where the report earns its place on a DNS site is the command-and-control design. Solar documented four routes out:

Look at the domains: four and five characters, meaningless, on rented server infrastructure in two of the oldest and most reputable generic top-level domains on the internet. A policy built around newly registered domains or unusual TLDs would not have touched one of them, and a manual DNS lookup returns nothing remarkable. Their only distinguishing feature is the shape of the traffic underneath — a telemetry problem, not a blocklist problem.

Why a dormant DNS tunnel defeats volumetric detection

Here is the part that should change how teams tune. Almost all published DNS-tunnelling detection assumes the tunnel is busy: high query rates to one zone, long or high-entropy labels, elevated TXT and NULL ratios, sustained NXDOMAIN volume. They work because exfiltration over DNS is slow, so moving real data means moving a lot of it.

A backup channel has the opposite profile by design. DNSCat2 and PartisanDNS were not carrying a database out of this network — Telegram and the proxy chain were doing the work. They existed to be there when the others were not, so their expected traffic is a heartbeat: a few lookups, occasionally, to a domain that resolves normally. Every volumetric threshold in the stack is tuned to ignore exactly that.

Volumetric reasoning is correct for a DDoS attack, where the volume is the signal. It inverts for a channel built to stay under the volume at which anyone looks. The detectable property is not magnitude but persistence: one host asking for one unremarkable domain, in small amounts, across months. That needs resolver logs that exist, are attributable to a host, and are retained long enough to span the behaviour. Two years is longer than most organisations keep DNS telemetry.

One caveat, increasingly relevant: this only holds where the endpoint actually uses your resolver. A host resolving over DNS over HTTPS to an external provider takes its queries out of your logs entirely, and a tunnel on it goes invisible. DoH is good for users on hostile networks and bad for this detection at the same time.

The trust graph is the blast radius

Solar's explanation for the absence of destruction is explicitly a hypothesis: the access was likely worth more intact, for espionage and for onward attacks through the victim's trusted relationships. That reframes what was breached. The valuable asset was not the hosts but the organisation's position as a hub holding bidirectional trust into subsidiary medical institutions. Machines touched is the wrong measure of damage; organisations reachable through them is the right one.

In most federated estates that trust lives in plumbing an administrator set up years ago and has not revisited: forest and domain trusts, conditional forwarders and stub zones pointing at a partner's name servers, links kept open for a shared clinical application. Those forwarders are both the map and the road — they name the other organisations and their internal namespaces, and they are already permitted, so using them raises nothing. A group that cannot list every conditional forwarder and trust its directory holds does not know the size of its own blast radius.

What IT security teams should do this week

1. Inventory installed-but-unused agents. Anything with a vendor directory and no owner is a candidate.
2. Verify signatures inside trusted software directories. An unsigned DLL in a vendor path is the low-noise signal that would have fired here.
3. Alert on Event ID 7045 for services launching from application directories. Legitimate services rarely start from a guest-agent folder.
4. Re-tune DNS detection for persistence, not volume, and confirm retention actually spans months.
5. Enumerate conditional forwarders, stub zones and directory trusts, and reconcile each against a current business reason — the IT security task with the best effort-to-risk ratio here.
6. Confirm which resolver your managed endpoints really use, not which one policy says they should. Benchmarking from the endpoint settles it.
7. Re-open old antivirus hits. Detections for Vasilek and GOST already existed here. Alerts deployed but never investigated are how a two-year intrusion stays one.

Industry impact

Read alongside the rest of this month, this data breach update completes a pair. Two weeks ago a credential-stealing campaign in GitHub Actions posted everything it took to a hard-coded address, so the exfiltration generated no DNS query at all. Here the opposite holds: two of four channels are nothing but DNS. Resolution is a checkpoint attackers decide about deliberately, and the decision goes both ways. Smash-and-grab skips it; multi-year espionage builds on it, because DNS is the egress path still working once the firewall rules are tightened and the messenger apps blocked.

What organisations can plan around is duller. There was no exploit, no CVE and no new technique; the intrusion needed several ordinary controls absent in one place at once — signature checking in application directories, service-creation review, long-horizon DNS baselining, and an accurate map of inter-organisational trust. The useful reading of this data breach update is that dwell time measured in years is rarely one spectacular failure. It is four boring gaps that overlapped, and the one open longest was the resolver that answered every question and kept no record worth reading.

Sources

• The Hacker News — Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
• Cyber Security News — Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations
• GBHackers — Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks

Related articles

• Data Breach Update Alert: 70,000 Firewall Logins Exposed October 26, 2026 · Data breach update
• Legal Aid Records Reach Back to 1978 October 16, 2026 · Data breach update
• DNS Security Alert: One Request Crashes HTTP/3 Servers October 25, 2026 · DNS security

Browse every DNS news article by month →

DNS angle

Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.

Source: Cyber Security News — Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations (2026-10-07).