### Persistent Espionage Over Destructive Attacks Russian cybersecurity firm **Solar** has uncovered a sophisticated and prolonged intrusion by a Belarus-aligned hacktivist group, **Partisan Zmiy** (also known as the **Cyber Partisans**), into a Russian healthcare organization. The group maintained a presence within the network for nearly two years, from early 2024 until its discovery in December 2025. Historically, **Cyber Partisans** have been known for destructive attacks against industrial and government targets in Russia and Belarus, often deploying a backdoor named **Vasilek** that utilizes **Telegram** for command-and-control (C2) and data exfiltration. They have also leveraged phishing campaigns to deliver **FortiClient VPN** alongside the open-source **DNSCat2** for host control. Furthermore, the group is associated with the **Pryanik** wiper and the **Evlx** utility for clearing Windows event logs. ### Shifting Modus Operandi This latest incident, however, represents a notable shift. Unlike previous operations, the threat actors refrained from destructive activities during their extended stay. **Solar** hypothesizes that the value of the extensive infrastructure and trusted relationships with numerous subsidiary medical institutions held by the attacked organization likely motivated this prolonged espionage, aiming for further intelligence gathering and potential supply chain attacks. ### Stealth and Evasion Techniques The intrusion involved a loader-scheduler service masquerading as a legitimate **VMware** component, dubbed "vmauad," to achieve persistence and evade detection. The attackers exploited a trusted-but-unmonitored **VMware Tools** directory, planting malicious executables or replacing legitimate **VMware DLLs** with a malicious version (e.g., "vmtools.dll") containing the backdoor. The rogue Windows service was configured to launch a binary, "C:\Program Files\VMware\VMware Tools\authd.exe," which, in addition to initiating a **GOST tunnel** weekly, executed an updated version of the **Vasilek** backdoor (version 1.5.8) eight hours after service startup. ### Vasilek's Evolving Capabilities The **Vasilek** backdoor is highly capable, designed for extensive information collection, Windows command execution, process management, file transfer, screenshot capture, keylogging, and privilege escalation via `runas`. A new addition observed is the "move_cursor" command, allowing the backdoor to simulate user input. **Solar** notes that the group prioritizes stealth and operational security, employing techniques like hostname binding, scheduled payload launches, system proxy inheritance, and disguise as legitimate software. ### Broader Threat Landscape Disclosures This discovery comes amidst other recent disclosures from **Solar**. The firm also reported on **HypeAgent**, a new full-featured Windows trojan distributed via phishing campaigns using JavaScript attachments. **HypeAgent** can steal files, control webcams, log keystrokes, launch hidden **VNC** and **RDP** sessions, and even deploy cryptocurrency miners. It targets credentials from platforms like **Discord**, **Steam**, **GitHub**, **Instagram**, **Telegram**, **Binance**, **ChatGPT**, **Claude**, and **Cursor**, and can tamper with **Exodus wallet** apps to steal sensitive financial information. Additionally, **Solar** observed legitimate infrastructure compromised by the **ProxyCB** proxyware botnet, making automated requests to Russian websites. Possible overlaps were identified between **ProxyCB** infrastructure and historical activity linked to **TeamSpy**, a threat cluster known for abusing **TeamViewer** for cyberespionage. ### Recent Law Enforcement Action In related news, the U.S. Department of Justice (**DoJ**) recently charged **Searzhudin Tamirlanovich Aktulaev**, a 40-year-old Russian national, for exploiting an online messaging service of a freelance employment platform. Between 2016 and 2017, Aktulaev allegedly used 255 fake accounts to send malware-laced Excel attachments to approximately 80,000 users, deploying **TVRAT** (also known as **Sheldor**, **SpyAgent**, **TeamBot**, **TeamSpy**, and **TVSPY**) and **DarkVNC** to harvest and exfiltrate data from thousands of infected computers. These ongoing reports underscore the persistent and evolving threat landscape facing organizations, emphasizing the need for robust defensive strategies and continuous monitoring.