Operation BarrelFire: Targeting Kazakhstan Oil & Gas

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025, particularly focusing on KazMunaiGas employees. The campaign uses spear-phishing emails with malicious ZIP attachments containing LNK files. These files download batch scripts, which in turn retrieve PowerShell loaders dubbed DOWNSHELL. The infection chain progresses through multiple stages, ultimately leading to the deployment of a malicious DLL implant. The threat actor employs various techniques to evade detection, including AMSI bypass and reflective DLL injection. The infrastructure used by NoisyBear is hosted on sanctioned web services, and the group is suspected to be of Russian origin based on language artifacts and targeting patterns.

• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• July 2026 Threat Trend Report on APT Attacks (South Korea)Campaign2026-08-28
• From Phishing to Persistence: A CrySome RAT Infection Chain AnalysisMalware2026-07-07
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13