Belarusian Cyber Partisans Confirm 2023 Breach of Moscow Health Network

The Belarusian hacktivist group admits to spending months inside the Moscow Department of Health system, validating earlier Russian security research findings.

Threat Times Intrusion DeskOctober 9, 20262 min read

Share LinkedIn Reddit

Illustration: A generic desktop computer sits on a cluttered desk inside a dimly lit office. — AI-generated illustration: Threat Times

Key points

Belarusian Cyber Partisans confirmed they breached the Moscow Department of Health network in 2023.
The group admits to maintaining access within the infrastructure for several months.
Russian researchers previously identified the intrusion, a finding the group has now corroborated.

The Belarusian Cyber Partisans have publicly admitted to breaching the computer network of the Moscow Department of Health in 2023. This confirmation validates earlier findings from Russian security researchers who had previously attributed the intrusion to the group.

According to a report by The Record, the hacktivist group concurred with the research conducted by Russian analysts, acknowledging that they spent months operating inside the healthcare network. The admission serves as a direct confirmation of the timeline and actor responsible for the compromise of the Moscow municipal health authority’s systems.

Context and Background

The disclosure highlights a rare instance of a threat actor confirming the specific details of an intrusion reported by opposing-side researchers. In this case, the Belarusian Cyber Partisans did not dispute the core findings of the Russian security investigation. Instead, they agreed with the assessment that their operations had penetrated the Moscow Department of Health infrastructure.

The breach occurred in 2023, during a period of heightened cyber activity between Belarus and Russia. The fact that the group spent months inside the network suggests a persistent access scenario rather than a one-time exfiltration event. This duration allows for a deeper understanding of the potential scope of the compromise, although specific data types or exact entry points were not detailed in the confirmation reported by The Record.

Who Is Affected

The primary entity affected is the Moscow Department of Health, a critical state infrastructure body responsible for public health services in Russia’s capital. The breach represents a significant security incident for a government healthcare provider, given the sensitive nature of medical records and the operational importance of health networks.

While the confirmation focuses on the actor and the target, the broader implications involve the integrity of Russian state healthcare data. The involvement of Belarusian actors in compromising Russian infrastructure underscores the complex geopolitical dynamics influencing cyber threats in the region. Security professionals monitoring the region should note this cross-border activity as part of the ongoing threat landscape.

What should you do?

Security teams should review their network monitoring logs for signs of persistent access, particularly in healthcare and government sectors. Organizations should verify that their incident response plans account for long-term intrusions where threat actors may remain dormant for months.

What to do and how to stay safe: Belarusian Cyber Partisans

Review network logs for unusual persistence mechanisms or long-term access patterns that may indicate a dormant threat.
Verify that segmentation controls are effective to limit lateral movement within critical healthcare or government networks.
Monitor threat intelligence feeds for updates on Belarusian hacktivist groups and their known tactics.
Ensure that incident response procedures include steps for detecting and removing unauthorized access that has been present for extended periods.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.