Russian APT Attacks Kazakhstan's Largest Oil Company

A Russia-linked threat actor has attacked Kazakhstan’s oil and gas sector, with researchers from Seqrite Labs naming the group “Noisy Bear.” Noisy Bear reportedly compromised a Kazakhstan-based KazMunayGas (KMG) finance department employee’s email and sent phishing messages to other staff, urging recipients to review schedules and wages in connection with changes in corporate policy.

The attackers directed victims to a zip file containing a decoy document and a shortcut file named “Salary Schedule.lnk,” which downloaded a PowerShell loader called “DownShell.” DownShell comprises two scripts, the first of which undermines AMSI, while the second-stage script uses CreateRemoteThread Injection to hijack File Explorer and create a covert remote shell.

Seqrite Labs notes the activity aligns with intelligence-gathering and long-term access, and the attackers are said to have used a sanctioned Russian bulletproof hosting provider, Aeza Group. Kazakhstan’s largest oil company, a state-owned entity, denies being attacked and describes the incident as a security exercise.