Cyber PartisansThreat actor
The Cyber Partisans, a hacktivist group based in Belarus, has been involved in various cyber-attacks targeting organizations and infrastructure in Belarus and Ukraine. They have hacked and wiped the network of the Belarusian Telegraph Agency, targeted the Belarusian Red Cross, and conducted ransomware attacks on the Belarusian Railway and Belarusian State University.From MISP Galaxy
Last reported 3 days ago, by The Hacker News4 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1036Masquerading
“CL-STA-1178: An Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets.”
- T1110.004Credential Stuffing
“…omino's Pizza cred-stuffing attack: Domino's Pizza is contacting users and urging them to change their password after suffering a credential-stuffing attack that compromised their accounts this month.”
- T1199Trusted Relationship
“"The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions," Solar said.”
- T1543.003Windows Service
“The primary responsibility of the Windows service is to launch the rogue binary "C:\Program Files\VMware\VMware Tools\authd.exe" that, besides launching a GOST tunnel every Saturday from 10 p.m.”
- T1552.004Private Keys
“GoBalance bug exposes onion private keys: A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services.”
- T1685.005Clear Windows Event Logs
“…tor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion“…ian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“Partisan Zmiy (Cyber Partisans): Rostelecom says Belarusian hacktivist group Cyber Partisans breached and stayed hidden in a Russian healthcare organization for two years in what appears to be a classic espionage operation.”
-
Belarusian hacktivists admit to 2023 breach of Russian state healthcare network“The Belarusian Cyber Partisans concurred with Russian research that they indeed spent months inside the network for the Moscow Department of Health.”
-
Belarusian hacktivists spent two years inside Russian healthcare network, researchers say“Russian cybersecurity researchers attributed a quiet two-year espionage campaign to the Belarusian Cyber Partisans, a group better known for public attacks against governments and infrastructure.”
Indicators in its reports
named in the reports above- sonechkoflea.bsky[.]socialin 1 report
- angrystaffer.bsky[.]socialin 1 report
- eliothiggins.bsky[.]socialin 1 report
- specialkhersoncat.bsky[.]socialin 1 report
- hxxps://bsky[.]app/profile/bsky.realhackhistory.org/post/3mxe77s6jpc23in 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.