Russian cybersecurity firm Solar says attackers had access to an unnamed Russian healthcare organization from early 2024 until the company discovered the intrusion in December 2025. Solar attributed the activity to the Belarusian Cyber Partisans. The public account says sensitive medical data was accessed, but gives no patient or record count and does not confirm that data was taken out of the network.
What happened, and when was it discovered?
Solar’s investigation traced the earliest signs of compromise to early 2024 and the discovery of the intrusion to December 2025, according to The Record’s October 5, 2026 report. That is nearly two years between the earliest observed signs and discovery; it does not establish the exact date the attackers first entered or prove uninterrupted access throughout that period.
As an Amazon Associate I earn from qualifying purchases.
The victim was not named. Solar reportedly said it had extensive infrastructure and connections to numerous other healthcare organizations. Those connections could have created opportunities to reach other targets, but the reporting does not say that any connected organization was compromised.
What did the attackers access?
Solar said the attackers accessed sensitive medical data. The public reporting does not identify the categories of information, quantify affected records or patients, or confirm exfiltration. Access to data should not be described as a confirmed, quantified patient-data breach or as proof that information was stolen.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
The organization’s systems were not reported as disrupted or destroyed. Solar researchers suggested the attackers may have avoided destructive activity because retaining access could have enabled further espionage or attacks exploiting trusted relationships. That is Solar’s interpretation of the motive, not established intent. A trusted-relationship attack uses access to one organization to try to reach another that trusts or connects to it; no successful move to another healthcare organization is reported.
Who does Solar say was responsible?
Solar attributed the intrusion to the Belarusian Cyber Partisans. This is the security firm’s assessment as reported by The Record, not an independently confirmed attribution or evidence of government direction. The group did not respond to The Record’s request for comment by publication.
Rank #2
- WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
- 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
- Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
- Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
- Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.
The Record reports that the Cyber Partisans emerged after protests following Belarus’s disputed 2020 presidential election and have claimed attacks on Belarusian government targets and, increasingly, Russian organizations. In July 2026, Russia’s Supreme Court designated the group an “extremist organization.” That is the court’s legal designation, not a neutral descriptor; The Record said it was the first time Russia had applied that designation to a hacking group. The group’s response to the ruling was not a comment on the healthcare intrusion.
What malware was reported?
The Record identified Vasilek as one tool used in the incident. It is a Windows backdoor that communicates with operators through Telegram. Reported capabilities include gathering information about an infected computer, running Windows commands, starting or stopping processes, transferring files, capturing screenshots, recording keystrokes, and updating or deleting itself. Solar said the version it examined was newer than the version Kaspersky first documented in 2025.
Rank #3
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
Solar reportedly said restrictions on Telegram in Russia made communications less reliable, while noting that operators could change communication methods. The reporting does not establish that Telegram was the attackers’ only channel or that restrictions stopped the operation. Vasilek’s reported functions describe the tool, not proof that every capability was used against this victim.
How did the attackers get in?
The accessible incident reporting does not identify the initial access method. It therefore does not establish whether the attackers used phishing, exploited a vulnerability, or entered by another route. The public account also does not provide enough verified detail to explain precisely how they maintained access for the reported period.
What remains unknown?
- The healthcare organization’s identity.
- The initial access vector and the precise persistence method.
- The number of people or records affected, and the kinds of medical information accessed.
- Whether any information was exfiltrated.
- Whether attackers reached any of the victim’s connected organizations.
These limits matter: the reported timeline and access to sensitive data are significant, but they do not answer how the intrusion began or establish the full scope of impact.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
