Attack on *stan: Your malware, my C2

A suspected state-affiliated threat actor has been targeting Kazakh and Afghan entities in a persistent campaign since at least August 2022. The attackers use a Windows-based RAT called KazakRAT, which allows for payload downloads, host data collection, and file exfiltration. The malware is delivered via .msi files and persists using the Run registry key. C2 communications are unencrypted over HTTP. The campaign also utilizes modified versions of XploitSpy Android spyware. Multiple KazakRAT variants have been observed with minor command-set changes. Victim targeting includes government and financial sector entities, particularly in Kazakhstan's Karaganda region. The operation shows low sophistication but high persistence, with similarities to APT36/Transparent Tribe activities.

• NanaZip 6.5 · DoSMediumVulnerability2026-08-18
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23
• Microsoft: Windows Server 2016 reaches end of support in JanuaryNews2026-10-23
• Infostealer riding the AI TrainMalware2026-10-23
• Microsoft says October updates didn’t actually fix VPN issuesNews2026-10-21