Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign

A new operation dubbed BarrelFire has been linked to a Noisy Bear threat group targeting Kazakhstan’s energy sector, with activity occurring since at least April 2025 and disclosed on 6 September 2025. The campaign is aimed at KazMunaiGas employees, delivering a fake document related to the KMG IT department and using themes such as policy updates and salary adjustments to entice victims, according to Seqrite Labs.

The infection chain begins with a phishing email containing a ZIP attachment that includes a Windows shortcut downloader (LNK), a decoy KazMunaiGas document, and a README.txt in Russian and Kazakh instructing users to run a program named "KazMunayGaz_Viewer," with the LNK payload dropping additional components and a PowerShell loader called DOWNSHELL before a DLL‑based implant establishes a reverse shell.

The adversaries reportedly used a compromised KazMunaiGas finance department address to target other employees in May 2025, and further analysis shows the threat infrastructure hosted on the Russia-based Aeza Group bulletproof hosting service. Security researchers note connections to Ghostwriter‑affiliated operations, though the focus remains on Noisy Bear’s BarrelFire activity against Kazakh energy assets.