Belarusian Hacktivists Acknowledge 2023 Intrusion into Russian Healthcare Infrastructure
The Belarusian Cyber Partisans have publicly confirmed their involvement in a 2023 breach of Moscow's Department of Health network, aligning with a recent disclosure by Russian cybersecurity firm Solar. In a statement released on Friday, the activist group stated they infiltrated the healthcare system and obtained administrator-level access to its entire infrastructure, which includes connections to other government agencies. They emphasized that the intrusion was not difficult to execute and that they maintained access for several months before disengaging.
The network was not a priority for us, so we did not maintain our access.
We gained full access to its entire infrastructure relatively quickly and with little effort.
The group further claimed that they currently retain access to hundreds of IT systems across both Russia and Belarus, although this assertion could not be independently verified by Recorded Future News or other sources at the time of reporting.
Solar Links Breach to Cyber Partisans, Notes Extended Dwell Time
The admission by the Cyber Partisans follows a report issued last week by Solar, a subsidiary of the state-owned telecom conglomerate Rostelecom. Solar identified the group as the likely actor behind a prolonged intrusion into an unnamed Russian healthcare organization. According to Solar’s analysis, the breach was first detected in December 2025, with initial signs of compromise traced back to early 2024 — indicating a potential dwell time of nearly two years.
However, the Cyber Partisans countered this timeline, asserting they gained access a year prior to Solar’s detection and had already ceased operations by the time the firm discovered the intrusion. They stated they did not attempt to maintain persistence after achieving their objectives.
Solar reported that the compromised healthcare entity operated a vast IT network linked to numerous other medical institutions, which could have enabled lateral movement to additional systems. Researchers confirmed that sensitive medical data was accessed during the intrusion, though no data destruction or operational disruption was observed.
Motivation Tied to Intelligence Gathering on Ukraine Conflict
While the specific data exfiltrated was not disclosed, the Cyber Partisans told Recorded Future News that information gathered during such cyber operations could assist in assessing Russian military casualties in the ongoing war in Ukraine. The group emphasized that most of their current activities remain classified for operational security and that details derived from the Moscow healthcare breach would not be released.
We take this opportunity to acknowledge responsibility for the hack and agree with the report's authors on at least one point: No matter how hard the Russians try to defend their systems, the Cyber Partisans ‘find and will continue to find ways around’ their security measures.
Background: From Protest Movement to Designated Extremist Group
The Cyber Partisans emerged in the aftermath of the disputed 2020 Belarusian presidential election, which sparked widespread protests against President Alexander Lukashenko — a vote widely condemned as fraudulent by Western governments. Initially targeting Belarusian state infrastructure, including government networks and the national railway system, the group expanded its focus after Russia’s full-scale invasion of Ukraine in 2022.
Since then, they have conducted cyber operations aimed at intelligence gathering and disruption of Russian critical infrastructure. In July of the reporting year, Russia’s Supreme Court formally designated the Cyber Partisans as an "extremist organization," accusing them of seeking to destabilize both Russia and Belarus and to overthrow Lukashenko’s regime. This marked the first time Russia had applied such a label to a hacking group.
The group continues to operate covertly, leveraging its technical capabilities to support what it frames as resistance against authoritarian rule in both Belarus and Russia.
Source: The Record