NoisyBear Exploits ZIP Files for PowerShell Loaders and Data Exfiltration

The article reports that the threat actor NoisyBear has launched a cyber-espionage campaign named Operation BarrelFire, using specially designed phishing lures that imitate internal Kazakhstani energy sector communications. According to Seqrite Labs, the campaign was first observed in April 2025 and showed rapid escalation by May, with spear-phishing emails directing recipients to download a ZIP named Schedule[.]zip and run a shortcut file named Salary Schedule.lnk that ostensibly linked to updated salary policies.

The ZIP contained a decoy document, a README.txt, and a malicious LNK that invoked Windows PowerShell to download batch scripts (123.bat and it.bat) which in turn fetched two loader scripts, support.ps1 and a.ps1, from the attacker’s infrastructure. The infection chain includes AMSI bypass, in-memory code loading, and a 64‑bit DLL implant that injects a reverse shell and enables exfiltration of employee credentials and internal documents, with command-and-control and persistence via rundll32-based techniques.

Seqrite’s analysis also notes infrastructure hosted on a sanctioned Russian provider Aeza Group LLC and mentions additional web applications used as alternate C2 hubs.