The Belarusian Cyber Partisans healthcare hack claim now has a named target: the activist group said it entered the Moscow Department of Health’s network in 2023, obtained administrator-level access and later left the environment rather than keeping a foothold.
The admission, made in a Friday statement and reported by Recorded Future News, follows research from Russian cybersecurity company Solar that attributed a prolonged breach of an unnamed Russian healthcare organization to the group. Solar did not identify the victim. The link between Solar’s target and Moscow’s Department of Health rests on the Cyber Partisans’ own account, not confirmation from the department.
The group said its access included the department’s infrastructure and systems linked to other government agencies. It did not say which data it took, which systems or patients may have been affected, or provide evidence that would independently verify the claimed access.
What did Solar find in the Russian healthcare breach?
Solar, a subsidiary of state-controlled telecom company Rostelecom, said it discovered the compromise in December 2025. Its researchers traced the earliest indicators they observed to early 2024 and said the attackers had accessed sensitive medical information without destroying data or disrupting the organization’s operations.
That chronology does not settle when the intrusion began. The Cyber Partisans say they first entered in 2023 and spent months inside before abandoning the operation. Solar’s early-2024 date refers to the earliest evidence it found, rather than a confirmed initial entry date. Solar’s December 2025 discovery came later still.
Solar said the victim operated a broad network connected to numerous healthcare institutions. Such access could offer a route to additional targets, the researchers said. They assessed that the lack of destructive activity may reflect an effort to preserve access for espionage or a trusted-relationship attack, where an attacker compromises an organization that a later target already trusts.
How did the attackers maintain access?
Solar reported finding Vasilek, a Windows backdoor that communicates with its operators through Telegram. According to the researchers, the malware can collect system details, execute commands, move files, capture screenshots, record keystrokes and remove or update itself. Solar said Russian restrictions on Telegram made that communications channel less reliable, although an operator can change channels.
The Cyber Partisans told Recorded Future News that medical data gathered during operations can help it estimate Russian military losses in Ukraine. That statement does not establish what material was obtained from the healthcare network.
The group formed after protests over Belarus’s disputed 2020 presidential election and later expanded operations against Russian targets following Russia’s full-scale invasion of Ukraine. Russia’s Supreme Court designated the group an extremist organization in July, according to Recorded Future News. The known record here remains narrow: Solar attributes an intrusion at an unnamed healthcare entity to the group, while the group claims that entity was Moscow’s health department.
This story draws on original reporting from The Record.
