Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks

**Executive summary:** Solar 4RAYS investigated a multi-year intrusion by Partisan Zmiy into a medical organization in which attackers maintained long-term access using Vasilek (Telegram-controlled backdoor), GOST with DNS tunneling, and a custom loader (authd.exe) hidden in the VMware Tools directory; operators used scheduled and limited windows for tunnels, replaced signed DLLs for concealment, and leveraged service manipulation for persistence, with multiple overlapping infrastructure indicators and evidence suggesting espionage across trusted healthcare subsidiaries.