Security researchers have identified a hacking group with suspected connections to Kazakhstan that has targeted government agencies across multiple former Soviet states since January 2025. The group, tracked under different names by cybersecurity firms Cisco Talos and Recorded Future, has conducted at least eight campaigns against institutions in nine countries including Russia, Belarus, Armenia, Uzbekistan and Tajikistan. The hackers appear focused on obtaining sensitive information related to diplomatic affairs, economic policy, and strategic resources such as energy supplies and water systems.
The group typically uses phishing emails containing malicious attachments, sometimes sent from already-compromised government email accounts, and recently began exploiting software vulnerabilities to deliver malware. Researchers assessed with medium confidence that the group operates from Kazakhstan, based on evidence including Russian-language materials in their malware, testing activity originating from Kazakhstan, and operations aligned with the country’s time zone. The timing of some attacks near diplomatic meetings suggests potential interest in monitoring negotiations and international relations within the region.
Source: Read the full story at The Record
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
