02-10-2026
Partisan Zmiy: Back on the Radar
https://rt-solar.ru/solar-4rays/blog/7027/
Report completeness: High
Actors/Campaigns:
Cyber_partisans (motivation: cyber_espionage)
Threats:
Vasilek
Dnscat2_tool
Impacket_tool
Wmiexec_tool
Dll_hijacking_technique
Ollvm_tool
Timestomp_technique
Victims:
Medical organizations, Medical sector
Industry:
Healthcare
Geo:
Russian federation
TTPs:
Tactics: 8
Technics: 31
IOCs:
File: 15
Path: 18
Command: 1
Domain: 32
Hash: 15
IP: 3
Soft:
vmtools, Telegram, 3proxy, egram, CLOUDFLARE, Windows Service, OLLVM
Algorithms:
sha1, sha256, xor, exhibit, md5
Functions:
getUpdates, getFile, getChat, deleteMessage
Win API:
GetCommandLineA, GetTickCount64, GetComputerNameA, WinHttpGetIEProxyConfigForCurrentUser, ShellExecuteA, sendMessage, CreateProcessA
Win Services:
bits
Links:
https://github.com/frkngksl/NimExec