Russian cybersecurity researchers from Solar said that Belarusian "Cyber guerrillas" had been operating unnoticed in the computer network of a Russian medical organization for almost two years. They disguised a virus as a regular program and gained the ability to remotely control computers.
Russian cybersecurity researchers from Solar said that Belarusian "Cyber guerrillas" had been operating unnoticed in the computer network of a Russian medical organization for almost two years. They disguised a virus as a regular program and gained the ability to remotely control computers.
This was reported by The Hacker News, citing researchers from the Russian company Solar.
According to their data, the hackers penetrated the network in early 2024, but their presence was noticed only in December 2025. In order not to attract attention, the attackers hid the Vasilek virus among the files of VMware Tools - a program for working with virtual machines. With the help of the virus, they could steal files, take screenshots, monitor keystrokes and even move the mouse cursor. The hackers used Telegram to communicate with the infected computers.
The hackers did not attempt to take down the systems, although the group has carried out such attacks in the past. Russian researchers suggest that accessing the network was more valuable than destroying it, as the organization had connections to many other medical institutions that could be its next targets.
So far, Cyber Partisans have not publicly confirmed their involvement in the attack.
Earlier, dev.ua wrote that the Belarusian Cyber Partisans, together with the Silent Crow group, announced a large-scale attack on the Russian Aeroflot. According to the hackers, they had access to the airline's network for almost a year, after which they destroyed thousands of servers and disrupted its operation.
