A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.
According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.
Known to be active since at least 2020, the group has a track record of striking industrial enterprises and government agencies in Russia and Belarus with a backdoor called Vasilek that uses Telegram for command-and-control (C2) and data exfiltration.
Some of the attacks have also leveraged phishing lures to deliver an installer that simultaneously deploys the legitimate FortiClient VPN program on the system as well as an open-source program known as DNSCat2 that allows attackers to gain control of the infected host.
A notable aspect of the threat actor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.
The Rostelecom subsidiary said it discovered the intrusion in December 2025, although evidence suggests that the earliest signs of compromise date back to early 2024. The name of the targeted organization was not identified. The exact initial access vector used to breach the entity is also not known.
Unlike other attacks linked to Cyber Partisans, the threat actors remained on the network for an extended period of time without carrying out any destructive activity, marking something of a shift in modus operandi.
“The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions,” Solar said. “We hypothesize that the lack of infrastructure disruption is due precisely to the value of this access for further espionage and trusted relationship attacks.”
Observed as part of the intrusion is a loader-scheduler service (“vmauad”) that masquerades as a legitimate VMware component to maintain persistence and evade cursory inspection. To accomplish this, the attackers are said to have taken advantage of a trusted-but-unmonitored VMware Tools directory location to plant malicious executables or replace legitimate VMware DLLs with a malicious version (“vmtools.dll“) containing the backdoor.
The primary responsibility of the Windows service is to launch the rogue binary “C:\Program Files\VMware\VMware Tools\authd.exe” that, besides launching a GOST tunnel every Saturday from 10 p.m. to 11 p.m., runs an updated version of Vasilek (version 1.5.8) once, eight hours after the service begins.
Once installed, Vasilek is equipped to collect information about an infected computer, execute Windows commands, launch and terminate processes, transfer files, capture screenshots, record keystrokes, and escalate privileges via runas. It can also prevent the machine from going into sleep mode, and update or remove itself.
One new addition is the “move_cursor” command that, as the name implies, allows the backdoor to move the cursor and simulate user input on the victim’s screen.
“The group consistently invests in stealth and operational security, rather than new capabilities: hostname binding in two independent components, nightly scheduled payload launches, system proxy inheritance, disguise as legitimately installed but unused software, file rotation across the same paths, time-stomping, outgoing message suppression, and anonymous messages on behalf of the group in operator chats,” Solar said.
“The backdoor’s feature set has remained largely unchanged over four revisions. Due to Telegram being blocked in Russia by ISPs, communication between the Vasilek backdoor and C2 has become unstable.”
The disclosure comes as Solar also disclosed details of a phishing campaign that employs JavaScript attachments mimicking business-themed documents, such as payments and purchase orders, to deliver a previously unreported malware family known as HypeAgent.
The Windows malware is a full-featured trojan designed to take complete control over infected systems, packing the ability to steal files, open a console, change desktop wallpaper, turn on a webcam, log keystrokes, launch hidden VNC and RDP sessions, control the mouse, and even deploy a cryptocurrency miner.
It’s also capable of stealing cookies associated with Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, and Cursor, and tampering with the installed Exodus wallet app to inject JavaScript that can collect the victim’s password, PIN, mnemonic phrase, and private key.
Earlier this June, Solar also observed legitimate infrastructure compromised by the ProxyCB proxyware botnet malware making automated requests to Russian websites and online platforms, while identifying possible overlaps between the botnet infrastructure and historical activity linked to TeamSpy, a threat cluster known for abusing TeamViewer to facilitate reconnaissance and data theft.
Last month, the U.S. Department of Justice (DoJ) charged Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national extradited from Cyprus in May 2025, for exploiting an online messaging service of a well-known freelance employment platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017 using 255 fake accounts.
The attacks led to the deployment of two types of malware, a variant of the TVRAT (aka Sheldor, SpyAgent, TeamBot, TeamSpy, and TVSPY) and DarkVNC, to harvest and send data from a victim computer to a remote server under the attacker’s control. Thousands of computers are assessed to have been infected as a result of this scheme.
Click Here For The Original Source.
——————————————————–
