Belarus-Linked Hackers Lurked Inside Russian Healthcare Network for Two Years Using Hidden Backdoor

A Belarus-aligned hacktivist group silently infiltrated a Russian healthcare organization for nearly two years, deploying a sophisticated backdoor disguised as a legitimate VMware component to conduct covert espionage operations. What makes this case particularly instructive is not just the technical sophistication involved, but the deliberate patience that characterized every phase of the operation — a quality once reserved almost exclusively for nation-state actors.

Russian cybersecurity firm Solar disclosed the intrusion in a report revealing that the threat cluster known as Partisan Zmiy — also called Cyber Partisans — maintained persistent access to the unnamed organization's network from early 2024 until its discovery in December 2025. The extended dwell time and deliberate restraint from destructive activity marks a significant tactical shift for a group previously known for aggressive attacks on Russian and Belarusian infrastructure.

---

The Anatomy of a Long-Term Intrusion

A Backdoor Hiding in Plain Sight

At the core of this intrusion was a carefully engineered deception. The attackers deployed a loader-scheduler service named "vmauad" that masqueraded as a legitimate VMware component. By exploiting a trusted but unmonitored VMware Tools directory, the group planted malicious executables and replaced a legitimate VMware DLL — "vmtools.dll" — with a weaponized version containing their signature Vasilek backdoor.

Understanding how this type of implant operates in context is easier when you have a solid grounding in the different types of malware and how they function, particularly the distinction between backdoors, loaders, and trojans — all of which feature in this campaign.

The Windows service was programmed to launch a rogue binary at highly specific intervals. Every Saturday between 10 p.m. and 11 p.m., it established a GOST tunnel, and it activated an updated version of Vasilek — version 1.5.8 — exactly eight hours after the service first began running. This precise scheduling reflects a deliberate effort to blend malicious activity into periods of low network monitoring, exploiting the natural rhythms of an organization's IT operations.

Vasilek itself is a formidable tool. Once installed, it can:

• Collect system information and execute Windows commands
• Launch and terminate processes
• Transfer files and capture screenshots
• Record keystrokes and escalate privileges
• Simulate user input directly on the victim's screen via a newly added "move_cursor" command — a capability that could manipulate systems while appearing as entirely normal user activity

Because Telegram is blocked by Russian internet service providers, communication between Vasilek and its command-and-control infrastructure has reportedly become unstable — an operational constraint the group has not yet fully resolved.

Why the Hackers Held Back

What makes this intrusion particularly notable is what the attackers chose not to do. Cyber Partisans have a documented history of deploying destructive tools, including a wiper called Pryanik and a Windows event log clearing utility dubbed Evlx. Neither was used during this operation.

Solar's analysts believe the restraint was strategic. The targeted healthcare organization maintained extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions — making it a valuable gateway for further espionage and potential supply-chain style attacks against connected entities.

"We hypothesize that the lack of infrastructure disruption is due precisely to the value of this access for further espionage and trusted relationship attacks," Solar stated in its report.

This approach — prioritizing long-term access over short-term disruption — is a hallmark of advanced persistent threat actors and their methods. The fact that a hacktivist group is now operating with this level of discipline signals a meaningful shift in the threat landscape.

The group's operational security throughout the campaign was meticulous. Solar noted that Partisan Zmiy employed:

• Hostname binding across two independent components
• Nightly scheduled payload launches
• System proxy inheritance
• Disguise as legitimately installed but unused software
• File rotation and time-stomping
• Outgoing message suppression

"The group consistently invests in stealth and operational security, rather than new capabilities," Solar observed. "The backdoor's feature set has remained largely unchanged over four revisions." This consistency is itself a strategic asset — a stable, well-tested toolset generates fewer anomalies and attracts less attention than frequent code changes.

---

A Broader Threat Landscape Emerges

HypeAgent: A Parallel Campaign With Wider Reach

The Vasilek intrusion is not an isolated incident within Solar's recent threat intelligence findings. The firm simultaneously disclosed details of a separate phishing campaign delivering a previously unreported malware family called HypeAgent through JavaScript attachments disguised as business documents such as payments and purchase orders.

HypeAgent is a full-featured Windows trojan capable of:

• Stealing files and logging keystrokes
• Opening hidden VNC and RDP sessions
• Activating webcams and controlling the mouse
• Deploying a cryptocurrency miner

It also targets cookies from a sweeping list of platforms including Discord, Steam, GitHub, Instagram, Telegram, Binance, ChatGPT, Claude, and Cursor. Perhaps most alarmingly, it tampers with the Exodus cryptocurrency wallet application to inject JavaScript capable of harvesting passwords, PINs, mnemonic phrases, and private keys — representing a direct and tangible financial threat to affected users.

Additional Threat Activity: ProxyCB and the DOJ Charges

Solar also identified earlier activity in June 2026 involving legitimate infrastructure compromised by the ProxyCB proxyware botnet, which made automated requests to Russian websites while showing possible infrastructure overlaps with TeamSpy — a threat cluster known for abusing TeamViewer for reconnaissance and data theft.

Adding another dimension to the threat environment, the U.S. Department of Justice charged Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national extradited from Cyprus in May 2025, for a 2016–2017 scheme in which he used 255 fake accounts to send malware-laden Excel attachments to approximately 80,000 users of a freelance employment platform. The attacks deployed TVRAT and DarkVNC malware, infecting thousands of computers.

---

Implications for Healthcare Security and What to Do Next

The Healthcare Sector as a High-Value Target

The Partisan Zmiy campaign illustrates a maturing approach among hacktivist groups — one increasingly indistinguishable from state-sponsored espionage in its patience, precision, and operational discipline. Healthcare organizations with interconnected subsidiary networks represent high-value targets precisely because of the trusted relationships that make modern healthcare systems function. An attacker who compromises a central hub gains potential visibility into every connected entity.

Security challenges facing organizations with distributed and interconnected infrastructure are well documented, and healthcare environments — with their mix of legacy systems, shared credentials, and operational continuity pressures — are among the most exposed. The trusted-relationship attack model exploited here is not unique to this campaign; it is an established technique that will continue to be used against similarly structured organizations.

Defensive Priorities for Security Teams and Administrators

For security professionals and healthcare administrators, this case surfaces several concrete defensive priorities:

• Audit trusted software directories — including VMware Tools and equivalent vendor paths — for unauthorized file additions or DLL substitutions. Trusted directories are frequently overlooked precisely because they are assumed to be safe.
• Implement behavioral monitoring that flags unusual scheduled tasks, off-hours tunneling activity, and services launching at irregular but predictable intervals. The Saturday-night activation window in this campaign would have been detectable with the right alerting in place.
• Treat any organization with broad subsidiary relationships as a potential lateral movement target requiring elevated scrutiny. The value of access scales with the number of connected entities — meaning a breach at the center carries risk for the entire network.
• Verify DLL integrity within vendor application directories as part of routine endpoint hygiene. Replacing a legitimate DLL with a malicious one is an established technique that endpoint detection tools can be configured to flag.

For further context on how attackers maintain long-term access within complex environments, the MITRE ATT&CK framework provides a comprehensive, publicly accessible reference for the tactics, techniques, and procedures documented in cases like this one.

The patient, disciplined nature of this intrusion — sustained for nearly two years without triggering alarms — is a reminder that detection capability matters as much as prevention. An attacker who can remain undetected long enough will eventually find what they are looking for.