Search — “Cyber Partisans”

Rosstat confirmed it was targeted by a cyberattack but disputed the hackers' claims of data leakage or database compromise, saying suspicious activity was detected in time. The Belarusian Cyber Partisans and pro-Ukrainian Silent Crow claimed months of intrusion followed by a destructive wipe of servers and defacement of the main and regional websites, but these claims could not be independently verified. No technical indicators, commands, or detection details are published in the source, so hunters should rely on general monitoring for server wiping, domain controller compromise, and website defacement.

Solar reports Belarus-aligned Cyber Partisans (Partisan Zmiy) persisted ~2 years in a Russian healthcare organization using a fake VMware service 'vmauad' that launches a rogue authd.exe in the VMware Tools directory, or a malicious vmtools.dll replacing the legitimate DLL. The loader runs a GOST tunnel every Saturday 22:00-23:00 and Vasilek 1.5.8 eight hours after service start; Vasilek uses Telegram for C2/exfil. The group is also known for DNSCat2, the Pryanik wiper and event-log clearing via Evlx. Hunt for unexpected services/binaries in VMware Tools paths, Telegram API traffic from servers, timestomping and log clearing.