A technical analysis details how a threat group maintained undetected persistence inside a healthcare network for nearly two years using custom utilities like Vasilek for covert intelligence collection.
According to researchers, the group known as Cyber Partisans or Partisan Zmiy is behind the operation. Unlike other cases where they cause havoc, here the perpetrators preferred to remain silent for a long time. Experts estimate that their main goal was espionage, taking advantage of the access they had gained.
How they hid in the systems
To maintain access to the systems without being detected, the perpetrators used a clever trick. They placed dangerous files in a trusted but unmonitored folder of popular management software. At the same time, they used a service that disguised itself as a legitimate item to keep the path to the systems open.
The program used
The Vasilek program installed by the hackers allowed them to collect information, run commands, and record activity on systems. Solar notes that the group systematically invests in hiding its tracks and being discreet, avoiding destructive actions.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)