A look at the Belarusian Cyber Partisans, a hacking group that has released a huge data trove, including from the government and police, to undermine Lukashenko
Pilfered data includes lists of alleged police informants and information on government spies. Tweets: @runasand , @rj_gallagher , @rj_gallagher , @rj_gallagher , @rj_gallagher , @rj_gallagher , @rj_gallagher , and @rj_gallagher Tweets: Runa Sandvik / @runasand : According to the article, the Cyber Partisans “are preparing to shut down government computers with malicious software named X-App.” Wonder what they're referring to? https://www.bloomberg.com/... Ryan Gallagher / @rj_gallagher : They also obtained - mortality statistics indicating that thousands more people in Belarus died from Covid-19 than the govt has publicly acknowledged - video footage from police drones & detention centers - And they've hacked & sabotaged 240+ surveillance cameras in Belarus https://twitter.com/... Ryan Gallagher / @rj_gallagher : Data obtained by the hackers could be of major significance in the long-term, according to experts, bolstering international efforts to sanction Lukashenko & his subordinates, as the trove provides evidence of officials ordering beatings of citizens during last year's protests: https://twitter.com/... Ryan Gallagher / @rj_gallagher : The Cyber Partisans are pretty bold: they told me they hacked Belarus's interior ministry by having someone in Belarus physically enter a govt facility & break into a computer network there, leaving a backdoor that was further exploited by a team operating remotely. https://twitter.com/... Ryan Gallagher / @rj_gallagher : Moreover, in a fascinating development, the hackers are collaborating with former Belarusian police officers, who defected from the country last year, citing election fraud & violence against protesters. Ryan Gallagher / @rj_gallagher : Now, the hackers told me in an interview, they are preparing to shut down Belarus government computers with malicious software they call “X-App” & are planning for a period that they say will combine computer sabotage with physical uprising on the streets. Ryan Gallagher / @rj_gallagher : The group has penetrated some of the most secret govt databases in the country, obtaining: - a huge trove of recordings from a govt wiretapping system that intercepts phone calls - personal info on top govt officials & spies - a list of informants who reported activists to police Ryan Gallagher / @rj_gallagher : Wrote about an extraordinary ongoing hacking campaign in Belarus by a group called the “Cyber Partisans”, which has breached dozens of police & government databases in recent months in a bid to expose wrongdoing & overthrow the Lukashenko regime https://www.bloomberg.com/...
Context & Ripple Effects
The Cyber Partisans emerged from the protest wave that followed Lukashenko's disputed re-election — a crackdown that, as earlier coverage noted, put Belarus's once-thriving tech startup sector at risk as workers and companies reassessed the country. This profile documents how that dissent went digital: breaches of dozens of government and police databases, with leaks of informant lists, wiretap recordings, and evidence of officials ordering beatings of protesters.
The trove is notable for what it contradicts: mortality statistics indicating thousands more Covid-19 deaths than officially acknowledged. A year later, the same group had escalated from leaking to sabotage, including disruption of Russian supply lines through Belarus for the war in Ukraine.
First-order effects
- Named individuals face immediate exposure: lists of alleged police informants and personal details on top officials and spies are now public, while the leaked Covid mortality figures directly undercut the government's official statistics.
- The group's stated plan to deploy 'X-App' malware against government computers signals a shift from publishing stolen data to threatening operational shutdowns of state systems.
Second-order effects
- The Belarusian state's counter-moves have been offensive rather than defensive: Mandiant later attributed the Ghostwriter hack-and-leak operation in EU states partly to Belarus, and researchers traced years of ISP-level interception of foreign diplomats' traffic by the Belarus-linked MoustachedBouncer crew.
- Leak-driven dissent forces every institution holding digitized records — police, health ministries, surveillance operators — to treat its own databases as a political liability, raising the cost of the centralized data collection authoritarian governance depends on.
Third-order effects
- The pattern points toward hack-and-leak becoming a standard instrument of political conflict in both directions: dissidents like the Cyber Partisans expose state machinery while state-aligned crews run influence operations abroad, collapsing the line between activism and cyberwar.
- If groups can breach and sabotage core government systems from inside a country, regime stability increasingly depends on cybersecurity competence — a structural weakness for states that concentrated both surveillance and sensitive records in central infrastructure.
The trend: Hacktivist collectives are turning national data infrastructure into the primary battlefield between authoritarian governments and their domestic opposition, with state-aligned offensive operations escalating in response.