Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign

Source: https://thehackernews.com/2025/09/noisy-bear-targets-kazakhstan-energy.html

The threat involves a phishing campaign named BarrelFire, attributed to the threat actor group known as Noisy Bear. This campaign specifically targets the energy sector in Kazakhstan, aiming to compromise organizations critical to national infrastructure. Phishing campaigns like BarrelFire typically use deceptive emails or messages to trick recipients into revealing sensitive information, such as login credentials, or to deliver malware payloads that can establish a foothold within the victim's network. Although detailed technical indicators and exploit mechanisms are not provided, the campaign's focus on the energy sector suggests a strategic intent to disrupt or surveil critical infrastructure operations. The absence of known exploits in the wild indicates that the campaign may rely primarily on social engineering rather than exploiting software vulnerabilities. The campaign's high severity rating reflects the potential impact on confidentiality, integrity, and availability of energy sector systems, which are vital for national security and economic stability. Given the targeting of Kazakhstan's energy sector, the threat actor likely employs tailored phishing lures referencing industry-specific topics or current events to increase the likelihood of successful compromise. The campaign's recent emergence and coverage by trusted cybersecurity news sources underscore its relevance and the need for immediate attention by organizations in the region and potentially beyond.

Detailed information about Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign. Get real-time updates, technical details, and mitigati

Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign

Reddit Discussion: Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025. The campaign focuses on KazMunaiGas employees, using spear-phishing emails with malicious attachments. The infection chain involves a ZIP file containing a malicious LNK file and decoy document, which downloads a batch script, leading to PowerShell loaders (DOWNSHELL) and ultimately a malicious DLL implant. The threat actor uses various techniques including AMSI bypass, process injection, and reflective DLL loading. Infrastructure analysis reveals the use of sanctioned hosting providers and open-source post-exploitation tools. The group is believed to be of Russian origin based on language artifacts and targeting patterns.

Operation BarrelFire is a targeted cyber espionage and intrusion campaign attributed to the threat group NoisyBear, believed to be of Russian origin. The campaign has been active since April 2025 and specifically targets Kazakhstan's oil and gas sector, with a focus on employees of KazMunaiGas, the national oil and gas company. The attack vector primarily involves spear-phishing emails containing malicious ZIP attachments. These ZIP files include a malicious LNK (Windows shortcut) file alongside a decoy document to lure victims into executing the payload. Once the LNK file is executed, it triggers a batch script download, which subsequently loads PowerShell-based loaders known as DOWNSHELL. This loader then deploys a malicious DLL implant using advanced techniques such as AMSI (Antimalware Scan Interface) bypass, process injection, and reflective DLL loading to evade detection and maintain persistence.

The threat actor employs a sophisticated infection chain leveraging native Windows tools and scripting (T1218.011 - signed binary proxy execution, T1059.001 and T1059.003 - PowerShell and command-line interface, T1562 - defense evasion, T1055.003 - process injection, T1589.002 - spear-phishing with malicious attachments, T1105 - remote file copy). The use of AMSI bypass and reflective DLL loading indicates a high level of technical capability aimed at evading endpoint security solutions. Infrastructure analysis shows the use of sanctioned hosting providers and open-source post-exploitation tools, suggesting operational security measures to complicate attribution and takedown efforts. The campaign's focus on a strategic sector and use of tailored spear-phishing indicates a targeted espionage motive rather than broad financial gain or disruption.

Detailed information about Operation BarrelFire: Targeting Kazakhstan Oil & Gas. Get real-time updates, technical details, and mitigation strategies.

Operation BarrelFire: Targeting Kazakhstan Oil & Gas - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation BarrelFire: Targeting Kazakhstan Oil & Gas

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025, particularly focusing on KazMunaiGas employees. The campaign uses spear-phishing emails with malicious ZIP attachments containing LNK files. These files download batch scripts, which in turn retrieve PowerShell loaders dubbed DOWNSHELL. The infection chain progresses through multiple stages, ultimately leading to the deployment of a malicious DLL implant. The threat actor employs various techniques to evade detection, including AMSI bypass and reflective DLL injection. The infrastructure used by NoisyBear is hosted on sanctioned web services, and the group is suspected to be of Russian origin based on language artifacts and targeting patterns.

Operation BarrelFire is a targeted cyber espionage and intrusion campaign attributed to the threat group NoisyBear, active since April 2025. The campaign specifically targets Kazakhstan's oil and gas sector, with a focus on employees of KazMunaiGas, a major national oil and gas company. The attack vector primarily involves spear-phishing emails containing malicious ZIP attachments. These ZIP files include LNK shortcut files that, when executed, initiate a multi-stage infection chain. Initially, the LNK files download batch scripts that subsequently retrieve PowerShell loaders known as DOWNSHELL. This loader facilitates further payload execution, culminating in the deployment of a malicious DLL implant within the victim's system.

NoisyBear employs advanced evasion techniques to avoid detection and analysis. These include bypassing the Antimalware Scan Interface (AMSI), which is a Windows security feature designed to detect malicious scripts, and utilizing reflective DLL injection, a method that loads malicious DLLs directly into memory without touching the disk, thereby evading traditional file-based detection mechanisms. The infrastructure supporting this campaign is hosted on web services currently under international sanctions, complicating takedown efforts and attribution.

The group is suspected to be of Russian origin, inferred from linguistic artifacts found in the malware and the targeting pattern focusing on Kazakhstan's strategic energy sector. The campaign leverages multiple MITRE ATT&CK techniques such as T1218.011 (Signed Binary Proxy Execution: Mshta), T1204.002 (User Execution: Malicious File), T1562 (Impair Defenses), T1055.003 (Process Injection: Thread Execution Hijacking), T1589.002 (Drive-by Compromise: Malicious Link), T1059.001 (Command and Scripting Interpreter: PowerShell), T1567.002 (Exfiltration Over Web Service), T1078.002 (Valid Accounts: Domain Accounts), T1059.003 (Command and Scripting Interpreter: Windows Command Shell), and T1105 (Ingress Tool Transfer). Indicators of compromise include multiple file hashes, IP addresses, and domains associated with the campaign infrastructure.

A new Android SMS stealer family, named Qwizzserial, has been uncovered, primarily targeting users in Uzbekistan. The malware exploits the reliance on SMS for two-factor authentication in local payment systems, allowing fraudsters to intercept SMS messages and gain control over victims' finances. Distributed through Telegram, the Qwizzserial campaign mirrors the structure of Classiscam. The stealer has infected approximately 100,000 users, resulting in financial losses of at least US$62,000. The malware's effectiveness stems from the widespread use of SMS for various financial transactions in Uzbekistan, including P2P transfers, payments, and authorization confirmations, often serving as the sole security layer in the absence of 3D Secure or biometric authentication.

Qwizzserial is a newly identified Android malware family designed to steal SMS messages from infected devices. This malware primarily targets users in Uzbekistan, exploiting the prevalent use of SMS-based two-factor authentication (2FA) in local financial systems. By intercepting SMS messages, Qwizzserial enables attackers to bypass authentication mechanisms and gain unauthorized access to victims' financial accounts, facilitating fraudulent transactions and financial theft. The malware is distributed mainly through Telegram channels, mimicking the operational structure of the previously known Classiscam malware family. Qwizzserial has reportedly infected around 100,000 users, causing financial losses estimated at a minimum of US$62,000. The malware’s success is largely due to the reliance on SMS as the sole or primary security layer for payment authorizations, peer-to-peer transfers, and other financial operations in Uzbekistan, where more advanced security measures like 3D Secure or biometric authentication are often absent. Although no known exploits are currently reported in the wild beyond the initial infection vector, the malware’s capability to silently intercept SMS messages poses a significant threat to the confidentiality and integrity of user financial data. The lack of patch links or specific affected Android versions suggests that the malware exploits social engineering and distribution through Telegram rather than exploiting a specific software vulnerability.

MD5 of 85648d3c1106b2f19ac0a0f41e122d17258893e0

MD5 of 643753ce846339765ffe9f483c30e1652fc3d75e

SHA256 of 643753ce846339765ffe9f483c30e1652fc3d75e

SHA256 of 85648d3c1106b2f19ac0a0f41e122d17258893e0

MD5 of 0ff0182805e573533646992496d7b28602e9121d

MD5 of ec7cc098bdf56a58df93b1d6626786ab59224870

SHA256 of 0ff0182805e573533646992496d7b28602e9121d

SHA256 of ec7cc098bdf56a58df93b1d6626786ab59224870

Detailed information about Discovery of Qwizzserial: A New Android SMS Stealer Family. Get real-time updates, technical details, and mitigation strategies.

Discovery of Qwizzserial: A New Android SMS Stealer Family - Live Threat Intelligence - Threat Radar | OffSeq.com

Discovery of Qwizzserial: A New Android SMS Stealer Family

Librarian Ghouls, an APT group targeting entities in Russia and the CIS, has been conducting a campaign involving targeted phishing emails with malicious archives. The attackers use legitimate third-party software and scripts to establish remote access, steal credentials, and deploy an XMRig crypto miner. Their tactics include disabling security measures, scheduling tasks to cover their tracks, and exfiltrating sensitive data. The campaign primarily affects industrial enterprises and engineering schools in Russia, with some victims in Belarus and Kazakhstan. The group continues to refine its methods, focusing on data exfiltration, remote access, and email account compromise through phishing sites.

The threat involves the APT group known as Librarian Ghouls, which targets entities primarily in Russia and the Commonwealth of Independent States (CIS) through a sophisticated campaign. The attack vector is primarily phishing emails containing malicious archives that exploit social engineering to trick victims into executing payloads. The group leverages legitimate third-party software and scripting tools to establish persistent remote access, enabling them to steal credentials and exfiltrate sensitive data. Additionally, they deploy the XMRig cryptocurrency miner to illicitly mine Monero, thereby monetizing compromised systems. Their tactics include disabling security tools to evade detection, scheduling tasks to maintain persistence and cover tracks, and compromising email accounts via phishing sites to facilitate further lateral movement and data theft. The campaign mainly targets industrial enterprises and engineering schools, indicating a focus on sectors with valuable intellectual property and operational technology. The group continuously refines its methods, employing a range of MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job), T1036.005 (Masquerading), T1566.001 (Spearphishing Attachment), and others related to credential access, defense evasion, and command execution. While the campaign is currently concentrated in Russia, Belarus, and Kazakhstan, the use of legitimate tools and phishing makes it a flexible threat that could potentially affect similar targets elsewhere. No known public exploits exist for this campaign, and no specific vulnerable software versions are identified, indicating the attack relies heavily on social engineering and post-compromise tool usage rather than zero-day vulnerabilities.

Detailed information about APT carries out attacks with data theft and crypto miner deployment. Get real-time updates, technical details, and mitigation strateg

APT carries out attacks with data theft and crypto miner deployment - Live Threat Intelligence - Threat Radar | OffSeq.com

APT carries out attacks with data theft and crypto miner deployment

Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.

CVE-2021-25255 is a high-severity vulnerability identified in Yandex Browser Lite for Android versions prior to 21.1.0. The underlying issue is classified as CWE-20, which refers to improper input validation. This vulnerability allows remote attackers to cause a denial of service (DoS) condition in the affected browser. Specifically, the browser fails to properly validate certain inputs, which can be crafted by an attacker to trigger a crash or otherwise disrupt normal operation. The vulnerability does not require any privileges or authentication to exploit, and user interaction is necessary, such as visiting a maliciously crafted webpage or clicking a link. The CVSS v4.0 base score is 8.3, indicating a high severity level. The attack vector is network-based (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no user authentication needed (AT:N). However, user interaction is required (UI:P). The impact is primarily on availability, as the vulnerability leads to denial of service, potentially causing the browser to crash or become unresponsive. There is no indication of confidentiality or integrity compromise. No known exploits are currently reported in the wild, and no official patches or mitigation links are provided in the data, though the fixed version is 21.1.0. The vulnerability affects the Android platform specifically, targeting users of Yandex Browser Lite, a lightweight version of the Yandex browser designed for resource-constrained devices or users with limited bandwidth. The improper input validation could be triggered by maliciously crafted web content or URLs, making it a risk for users who browse untrusted or malicious websites.

Detailed information about CVE-2021-25255: CWE-20 Improper Input Validation in Yandex Browser Lite affecting Yandex Browser Lite. Get real-time updates, technic

Title	Severity	Type	Source	Date

Threats Affecting Kazakhstan

Filter Threats

Threats Affecting Kazakhstan

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility