Belarusian hacktivists admit months-long presence in Moscow health department network

What happened and what to do

The Record's article reports that the hacktivist group Belarusian Cyber Partisans confirmed it remained for months inside the network of the Moscow Department of Health, with the intrusion beginning in 2023. The group agreed with Russian research stating that it stayed for that prolonged period, and the case is presented as an intrusion into a state health network.

For a health organisation or a public service provider, the case shows that an attacker's prolonged presence is the central risk, more than the initial entry. In practice, Wendelmaques could implement centralised collection of authentication logs, access to systems holding patient data and lateral movement between servers, with enough retention for retrospective investigations. On that base, alerts would be defined for patterns outside the baseline, such as service accounts used at atypical hours and large data transfers. A monitoring dashboard for the security team and periodic threat-hunting routines are also possible. Everything would be designed and operated on the client's own infrastructure.

How the consultancy can help

Diagnosis of exposure to long-dwell intrusions: log review, monitoring coverage and access controls for sensitive systems. Then design and deployment of collection and detection pipelines, with dashboards and alerts operated on the client's infrastructure.

Next step

Send a short description of your environment and your case and receive a scoped proposal from Wendelmaques for diagnosis and implementation.