Loading story…
Solar researchers attributed a nearly two-year intrusion into an unnamed Russian healthcare organization to the Belarusian Cyber Partisans. Investigators discovered the compromise in December 2025 and traced the earliest evidence of access to early 2024. The attackers reportedly accessed sensitive medical information without apparent system disruption or destruction. Solar assessed that intelligence gathering and preserving access may have taken priority over immediate sabotage. The victim’s connections to numerous other healthcare organizations created potential opportunities for trusted-relationship attacks, but the reporting did not confirm any downstream compromises.
The operation used Vasilek, a Windows backdoor that communicates through Telegram and supports command execution, file transfers, screenshots, and keylogging. Additional reporting identified version 1.5.8, persistence through Windows services and replacement of a VMware Tools library, and alternative communications using DNS tunnels and proxy chains. Healthcare defenders should review service creation, validate VMware Tools library integrity, investigate unexpected Telegram traffic and DNS tunneling, and assess access granted through interorganizational connections. The attribution and espionage assessment remain researchers’ conclusions; one secondary account also carried a mismatched original-source link, limiting its independent corroboration.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
Russia's Supreme Court designated the Belarusian Cyber Partisans an extremist organization, accusing the group of seeking to destabilize Russia and Belarus. The ruling was reportedly Russia's first extremist designation of a hacking group.
Solar discovered the intrusion in December 2025 and found evidence that attackers had maintained access for nearly two years. Researchers reported access to sensitive medical data without apparent major disruption or destruction of the victim's systems.
Kaspersky first documented Vasilek, a Windows backdoor used by the Belarusian Cyber Partisans. The malware communicates through Telegram and supports command execution, file transfers, screenshots, and keylogging.
Evidence later examined by Solar traced the compromise of an unidentified Russian healthcare organization to early 2024. The organization operated extensive infrastructure connected to numerous other healthcare organizations.
The Belarusian Cyber Partisans claimed they breached the Moscow Department of Health in 2023 and obtained administrator-level access to infrastructure connected to other government agencies. The group said it abandoned the operation after months, contradicting Solar's assessment that access may have persisted for nearly two years.
Solar attributed the intrusion to the Belarusian Cyber Partisans and reported an updated Vasilek backdoor, identified as version 1.5.8. Reported techniques included persistence through Windows services and replacement of VMware Tools' vmtools.dll, alongside DNS tunnels and proxy chains for alternative communications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecysecurity.news
Open sourcetherecord.media
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian authorities said foreign hackers acting as **cyber mercenaries** breached multiple federal executive bodies and stole confidential information in a targeted campaign uncovered in 2020. A joint report from Rostelecom-Solar and the National Coordination Center for Computer Incidents said the intruders used three primary access routes: tailored spear-phishing, exploitation of internet-facing web application flaws, and compromises of government contractors that enabled trusted-relationship access into agency networks. After gaining entry, the attackers conducted internal reconnaissance, targeted administrators’ workstations and infrastructure management systems, and collected data from mail servers, document management platforms, file servers, and employee endpoints. Investigators said the operation relied on previously unseen malware, including **`Mail-O`** and **`Webdav-O`**, to provide stealthy backdoor access, execute commands, and exfiltrate data through Russian cloud services while mimicking legitimate **Yandex Disk** and **Mail.ru Disk-O** traffic. The report also said the attackers tailored their activity to evade detection by deployed security tools, including abuse of legitimate components of a widely used Russian antivirus product to gather information about victim networks.
Aug 14, 2026
The United States, United Kingdom, and Poland publicly attributed the **SolarWinds Orion** supply-chain compromise to Russia’s **SVR** intelligence service, describing it as part of a broader campaign of malicious cyber activity. The White House announced measures to impose costs on the Russian government, while the UK said a low single-digit number of its public-sector organizations were targeted and Poland warned that the fallout extended beyond the United States into Europe, aligning its response with **NATO** and **EU** statements. The campaign stemmed from trojanized Orion updates distributed in 2020 that deployed the **Sunburst** backdoor to fewer than 18,000 customers, with a smaller subset selected for follow-on exploitation. Subsequent disclosures showed the intrusion reached deep into U.S. government and enterprise cloud environments. The U.S. Department of Justice said attackers accessed Microsoft 365 email accounts at **27 U.S. Attorneys’ offices**, including severe exposure in multiple New York districts, while reports also identified breaches at **NASA** and the **FAA**. Technical analysis found the operators abused **Azure AD**, OAuth application permissions, and **Microsoft Graph API** access to impersonate trusted applications, escalate privileges, and exfiltrate email and tenant data. Industrial organizations were also exposed: Kaspersky estimated that **32.4%** of attributable domains tied to the malware belonged to industrial entities, with more than 20 such organizations found running backdoored Orion software across several countries.
Aug 15, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026