Kazakhstan's Diplomatic Documents Reportedly Targeted in Cyber Campaign

A cyber espionage campaign, allegedly connected to the Kremlin, has reportedly targeted Central Asian countries, including Kazakhstan, according to digital security firm Sekoia.
Infosecurity Magazine reports:
According to recent findings by cybersecurity firm Sekoia, the campaign involved weaponized Microsoft Word documents designed to deliver HatVibe and CherrySpy malware, collecting strategic intelligence on Kazakhstan’s diplomatic and economic relations.
The investigation began in October when Sekoia discovered a document in the VirusTotal database.
The attackers used a macro to activate malware on recipients' devices, first deploying the HatVibe backdoor, followed by the more sophisticated CherrySpy malware – a technique previously used against Ukrainian scientific institutions.
The compromised documents included diplomatic correspondence and administrative files from Kazakhstan's Foreign Ministry dating from 2021 to 2024.
The attack bears hallmarks of APT28, a group allegedly connected to Russia's GRU and funded by the Kremlin.
APT28 has a history of targeting diplomatic, defense and scientific sectors across Europe and Asia, often using spear phishing with malicious macros and scheduled task persistence, notes Infosecurity Magazine.
According to Sekoia's analysis:
The most recent documents are two diplomatic letters, one from the Embassy of Kazakhstan in Afghanistan, the second from the Embassy of Kazakhstan in Belgium, both intended for the central Ministry of Foreign Affairs regarding diplomatic cooperation and economic issues. The both are dated early September 2024.
The documents supposedly included materials related to President Toqayev's state visit to Mongolia and his meeting with American companies in New York.
The hackers also accessed a Kyrgyz Defense Ministry letter discussing military cooperation in Central Asia, which contained information about a "special operation by the PRC against Taiwan."
The UAC-0063 utility used in this campaign has previously targeted Ukraine, Israel, India, Kyrgyzstan, and Tajikistan.
Another major data breach in early 2024 included personal information about Kazakhstani security officials, though Kazakhstan's authorities never officially confirmed this. Chinese hackers had been stealing data from Kazakhstani information networks for two years.
Orda.kz has sent official inquiries to Kazakhstan's Foreign Ministry, the Ministry of Digital Development, Innovation and Aerospace Industry, and the Center for Analysis and Investigation of Cyberattacks.
Original Author: Nikita Drobny
Latest news
- Kazakhstan Continues Selling Gold Reserves
- Uzbekistan, Russia to Streamline Labor Migration Process
- Army Chief Urges Public to "Trust Official Statements" Amid Military Incidents
- Almaty Hostel Fire Trial Reopens to Press Coverage
- Direct Flights from Almaty to New York and Tokyo Expected in 2025
- Political Scientist Comments on Kulibayev's Reported Deal
- Crocus Terror Attack Investigation Completed
- Toqayev Meets Business Leaders Amid VAT Rate Discussions
- Import Reliance and Rising Prices: What’s Happening in Kazakhstan’s Pharmaceutical Market?
- Uzbekistan and Switzerland Agree on Return of $182 Million in Karimova Assets
- VAT Rate Increase: Atameken Chamber Holds Meeting
- Kazakhstan Leads EAEU in Price Growth but Trails in Some Areas
- Trump Suspends USAID Operations: How Does This Affect Kazakhstan?
- Slovakia Resumes Russian Gas Imports Via TurkStream
- Agricultural Cooperative Head Misuses Dairy Subsidies for Luxury Vehicle Purchase
- Prosecutors Recover 20,000 Hectares of Forest Fund from Private Businesses
- Billions Lost in Digital Development Programs, Audit Reveals
- Yerlan Zhagiparov: Court Issues Verdict in Qantar Case
- Aqsu District Court Chair Under Investigation for Corruption
- Trump Signs Order Sanctioning International Criminal Court