In a significant cybersecurity breach, a hacktivist group aligned with Belarus has infiltrated the network of a Russian healthcare organization for nearly two years. This intrusion, attributed to the group known as Partisan Zmiy or Cyber Partisans, was revealed by the Russian cybersecurity firm Solar.
Active since at least 2020, the group has targeted industrial and government sectors in Russia and Belarus using the Vasilek backdoor. This tool exploits Telegram for command-and-control and data extraction. Their attacks often include phishing schemes to deploy the FortiClient VPN along with DNSCat2, an open-source program enabling control over compromised systems.
Prolonged Network Presence
Unlike previous operations, the hackers maintained a long-term presence within the network without executing destructive actions, marking a shift in their strategy. The breached organization, as reported by Solar, had a vast infrastructure and trusted connections with various medical entities, possibly offering valuable espionage opportunities.
The intrusion was detected by a Rostelecom subsidiary in December 2025, although signs suggest the compromise began in early 2024. The exact method of initial access remains unidentified. During the breach, the hackers used a loader-scheduler service, ‘vmauad’, disguised as a legitimate VMware component to ensure persistence.
Advanced Evasion Techniques
To avoid detection, the attackers exploited the VMware Tools directory to deploy malicious executables. The Windows service launched a rogue binary, which activated a GOST tunnel and an updated Vasilek backdoor version on a weekly schedule. This backdoor could perform various tasks, including data collection, command execution, and privilege escalation.
A notable addition to Vasilek’s capabilities is the ‘move_cursor’ command, simulating user input. The group prioritizes stealth and operational security, employing techniques such as hostname binding, disguised payloads, and anonymous communication on operator chats.
Continued Cyber Threats
The disclosure coincides with Solar’s report of a phishing campaign using JavaScript attachments to spread a new malware family, HypeAgent. This malware can fully control infected systems, steal sensitive data, and even deploy cryptocurrency miners.
Meanwhile, Solar identified the ProxyCB proxyware botnet malware, which automated requests to Russian sites, hinting at links to TeamSpy, a group known for using TeamViewer for data theft. In a related incident, the U.S. Department of Justice charged a Russian national for distributing malware-laden attachments via a freelance platform, infecting thousands of computers.
These incidents underscore the persistent threat of cyber attacks and highlight the need for robust cybersecurity measures to protect critical infrastructure from sophisticated adversaries.
