Cyber Partisans maintained persistent access to Russian health network almost two years, according to Solar

A hacktivist group aligned with Belarus remained within the network of a Russian health organization almost two years before being discovered, according to a technical report published by the Russian solar cybersecurity firm. The activity is attributed to a cluster known as Partisan Zmiy o Cyber Partisans, an active actor at least since 2020 who had already used a backdoor called Vasilek and tools such as DNSCat2 in previous intrusions.

confirmed facts: Solar identifies a prolonged intrusion detected in December 2025 by a subsidiary of Rostelecom, although forensic evidence points to commitments dating from early 2024. The attacker installed a persistence designed to appear legitimate within the VMware Tools directory, replacing or planting binaries on a reliable and unguarded route. The piece in charge of persistence - a service described as "vmauad" that launches "C:\ Program Files\ VMware\ VMware Tools\ authd.exe" - starts a GOST tunnel on a fixed weekly schedule and runs version 1.5.8 of the Vasilek backdoor after starting the service. Vasilek can steal computer information, run commands, transfer files, take screenshots, record press, raise privileges through runes and simulate user interaction (new "move _ cursor" command). Solar also documents constant camouflage techniques: modification of time marks, rotation of files on repeated routes, system proxy heritage and programmed launches to reduce signs of immediate activity.

Technical aspects and modus operandi: the attackers took advantage of the operational confidence that exists around VMware Tools. That folder is usually treated as "santa" by administrators (legitimate signed files, updates out of strict controls), which makes it easier to place DLL or malicious executables that pass unnoticed in surface inspections. In addition to the backdoor, group histories show the use of DNSCat2 and installers that deploy legitimate software (e.g., FortiClient) along with malicious components, a technique that makes it easier to avoid controls and maintain "normal" telemetry in endpoints; DNSCat2 is a known open project that facilitates C2 channels through DNS (see the implementation in GitHub - dnscat2). The presence of a GOST tunnel and fixed communications times indicate an effort to keep remote access stable even when the main channel (Telegram) is blocked in Russia, which has caused C2 instability in previous incidents.

To whom it affects and why it matters: the affected entity was a health provider with extensive infrastructure and two-way trust with multiple medical institutions. That turns sustained access into risk for intelligence, massive theft of health data and chain of trust attacks(pivot to third-party systems using the relationship). If it had been decided to activate destructive tools that the group has used before (e.g. a wiper called Pryanik and an Evlx log cleaner), the impact could have reached the unavailability of clinical systems and erased records, with direct consequences for patient care. In this particular incident Solar reports that there was no destructive activity during the access reserve, suggesting interest in espionage or preparation for future operations.

Differences in previous campaigns: Cyber Partisans has deployed in the past dual-use facilities (legitimate installer + DNSCat2), and has carried out destructive attacks. Here, however, it is observed a prolonged stay without destruction, which is a tactical deviation: the value of persistent access to an extensive health network probably motivated priority collection and lateral movements over the immediate activation of wipers.

Information still uncertain or estimated: the exact initial entry path has not been publicly confirmed; Solar did not identify the name of the organization under attack. Geo-political attribution (alignment with Belarus) and definitive intentions - although plausible according to the infrastructure involved - are estimates based on indicators, historical tactics and observed objectives, not irrefutable evidence of the final objective of the operation.

Practical consequences: sustained exposure of a health network can result in exfiltration of medical records, access credentials, and materials for future supplanting attacks against partner organizations. In addition, the use of legitimate routes (official installers, VMware directories) complicates detection and can allow attackers to reenter even after partial cleaning.

Specific recommendations for IT and IR responsible (confirmed by incident response practices): immediately isolate suspicious systems and preserve forensic images; perform a specific sweep on VMware routes Tools in physical and virtual machines looking for unusual files (authd.exe not signed or vmtools.dll replaced); audit tasks / services programmed for off-schedule activities (e.g. weekly GOST tunnel executions); review preserved event logs and search for time-stomping or log cleaning signals; rotate privileged credentials and force MFA in administrative access; and verify the presence of utilities such as DNSCat2 or the use of installers that pack FortiClient with unsigned components (FortiClient: Fortinet - FortiClient).

Additional technical measures: Harden monitoring of management software routes (not assuming that VMware directories are clean), apply white lists of critical binary applications and signatures, deploy behavior detection for keylogging and screenshot, and use EDR to detect replacements from DLL and impostor services. At the organizational level, limit trust relationships and inter-agency access by default, apply segmentation and review integrity agreements with third parties.

Precautions for end-users and health professionals: do not open JavaScript attachments or unexpected mail macros, verify remits and validation channels, keep backups out of line and tested, and report anomalies in clinical equipment immediately. Solar has also linked, in the same dissemination, phishing campaigns that distribute a new family of Trojans called HypeAgent who steal cookies and credentials and can open hidden VNC / RDP, so the caution against "false" attachments with invoices or purchase orders is key.

Open context and resources: this incident fits into a trend where actors who previously carried out destructive attacks sometimes opt for long-term operations to obtain intelligence and access to third parties. To understand the tools referred to in the technical findings, see the public implementation of DNS tunnel DNScat2 in GitHub ( dnscat2) and documentation of endpoint solutions such as FortiClient ( FortiClient).

In short, novelty is not just the tool: it is strategy. The group's ability to stay for almost two years in a large, undetonated, destructive health network shows that the greatest danger can be the long-term collection of information and the preparation of operations against reliable third parties. Organizations that maintain trust should prioritize detection on traditionally "immune" routes to inspection and assume that a commitment may have occurred well in advance of discovery.