Partisan Zmiy Malware Campaign Uses Telegram and DNS Tunneling to Target Healthcare Networks

A prolonged Partisan Zmiy intrusion into a medical organization, exposing an updated malware toolkit that combined Telegram command channels, DNS tunneling, and scheduled payload execution.

Investigators joined the response in December 2025 and traced the earliest evidence of compromise to early 2024, indicating approximately two years of access without observed destructive activity.

The organization maintained extensive infrastructure and bidirectional trust relationships with subsidiary medical institutions.

Researchers assess that preserving these connections may hav…