Cyber Partisans Confirm 2023 Admin Access to Moscow Health Network, Exposing Timeline Gap with Solar Report

The group publicly claimed the 2023 intrusion after Solar, a Rostelecom subsidiary, published indicators in December 2025 attributing a long-running healthcare breach to the Partisans with earliest activity dated to early 2024. The Partisans stated they gained full access quickly with minimal effort, maintained persistence for months, then abandoned the operation without data destruction or operational disruption. Medical records were collected but specifics remain undisclosed for operational security.

Technical evidence consists of matching TTPs between the group's statement and Solar's IOCs, including persistence across an IT network connected to multiple healthcare and government entities. The Partisans noted weak segmentation allowed rapid lateral movement. No independent forensic confirmation of dwell time or exfiltrated data volume exists beyond the attackers' account.

Russia's Supreme Court designated the group an extremist organization in July, citing destabilization efforts, yet this attribution rests on policy rather than disclosed technical evidence. The Partisans separately claim ongoing access to hundreds of Russian and Belarusian systems, a figure unverifiable from open sources.

The operation demonstrates persistent low-priority targeting of health data for casualty estimation amid the Ukraine conflict. Further claims against interconnected Russian infrastructure are probable as medical networks remain poorly segmented from other state systems.