Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025. The campaign focuses on KazMunaiGas employees, using spear-phishing emails with malicious attachments. The infection chain involves a ZIP file containing a malicious LNK file and decoy document, which downloads a batch script, leading to PowerShell loaders (DOWNSHELL) and ultimately a malicious DLL implant. The threat actor uses various techniques including AMSI bypass, process injection, and reflective DLL loading. Infrastructure analysis reveals the use of sanctioned hosting providers and open-source post-exploitation tools. The group is believed to be of Russian origin based on language artifacts and targeting patterns.

Operation BarrelFire is a targeted cyber espionage and intrusion campaign attributed to the threat group NoisyBear, believed to be of Russian origin. The campaign has been active since April 2025 and specifically targets Kazakhstan's oil and gas sector, with a focus on employees of KazMunaiGas, the national oil and gas company. The attack vector primarily involves spear-phishing emails containing malicious ZIP attachments. These ZIP files include a malicious LNK (Windows shortcut) file alongside a decoy document to lure victims into executing the payload. Once the LNK file is executed, it triggers a batch script download, which subsequently loads PowerShell-based loaders known as DOWNSHELL. This loader then deploys a malicious DLL implant using advanced techniques such as AMSI (Antimalware Scan Interface) bypass, process injection, and reflective DLL loading to evade detection and maintain persistence.

The threat actor employs a sophisticated infection chain leveraging native Windows tools and scripting (T1218.011 - signed binary proxy execution, T1059.001 and T1059.003 - PowerShell and command-line interface, T1562 - defense evasion, T1055.003 - process injection, T1589.002 - spear-phishing with malicious attachments, T1105 - remote file copy). The use of AMSI bypass and reflective DLL loading indicates a high level of technical capability aimed at evading endpoint security solutions. Infrastructure analysis shows the use of sanctioned hosting providers and open-source post-exploitation tools, suggesting operational security measures to complicate attribution and takedown efforts. The campaign's focus on a strategic sector and use of tailored spear-phishing indicates a targeted espionage motive rather than broad financial gain or disruption.

Detailed information about Operation BarrelFire: Targeting Kazakhstan Oil & Gas. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'central asia'

Filter Threats

Threats Tagged 'central asia'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility