Noisy Bear: A New APT Group Is Spying on Kazakhstan’s Energy Sector

Seqrite’s analysis describes Noisy Bear as a newly discovered threat actor active since April 2025 and targeting Kazakhstan’s oil and gas sector, with initial and ongoing emphasis on KazMunaiGas (KMG). The group uses spear-phishing, PowerShell loaders and DLL implants, delivering a decoy document that imitates internal communication from KMG and masquerades as HR guidance to prompt opening a malicious ZIP attachment.

The campaign’s messages, tied to a deadline, urge recipients to review updated information on work schedules and salaries, and the decoy ZIP leads victims to a second ZIP containing a malicious shortcut file that runs an executable. Seqrite’s breakdown outlines four stages, from a malicious LNK that downloads a PowerShell loader to a DLL implant that hijacks rundll32.exe for a reverse shell, with AMSI evasion techniques to avoid detection.

While attribution remains cautious, Seqrite notes ties to Russian-speaking infrastructure—including hosting providers—and states the threat actor could be of Russian origin, according to Seqrite.