As noted by The Hacker News, a Belarus-aligned hacktivist group known as Cyber Partisans, or Partisan Zmiy, successfully maintained unauthorized access to a Russian healthcare organization for nearly two years.
The intrusion, identified by cybersecurity firm Solar in December 2025, likely began in early 2024. Unlike the group's typical destructive operations, the actors remained quiet to leverage the organization's extensive infrastructure and trusted relationships with medical subsidiaries for espionage. The attackers utilized a sophisticated loader-scheduler service named vmauad, which masqueraded as a legitimate VMware component to maintain persistence. By replacing or planting malicious DLLs within VMware directories, the group deployed an updated version of their Vasilek backdoor. This tool allows for comprehensive system control, including keystroke logging, file exfiltration and simulated user input. While the group previously favored destructive wipers, this campaign highlights a strategic shift toward long-term stealth. Solar researchers noted that the actors prioritize operational security, such as time-stomping and nightly payload launches, to evade detection. This incident underscores the evolving tactics of politically motivated threat actors who increasingly target critical infrastructure to exploit established trust networks for intelligence gathering rather than immediate disruption.
Source: The Hacker News
