Loading story…
Kazakhstan's state-owned oil and gas company KazMunayGas (KMG) has denied being compromised by the Russia-linked NoisyBear threat group, asserting that recent suspicious activity was part of an internal phishing drill. Seqrite Labs researchers reported that a KMG finance employee's email was used in a phishing campaign attributed to NoisyBear, which leveraged advanced techniques to establish covert access. KMG maintains the incident was a planned security exercise, while Seqrite Labs points to forensic evidence suggesting genuine espionage activity targeting critical energy infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported coordinated spearphishing activity targeting energy, oil and gas, electronics, and related supply-chain organizations, with notable focus on South Korean firms and entities in the UAE and Qatar. The lures impersonated legitimate business correspondence using spoofed or typosquatted email accounts and referenced real tenders, RFQs, procurement documents, executives, and major projects such as **ADNOC** and **Doha airport** work to increase credibility. The emails delivered malicious `IMG`, `ISO`, `CAB`, `PDF`, `ZIP`, and .NET loader chains, often hosted through legitimate services including **WeTransfer** and **Mega**, to install information-stealing malware such as **AZORult**, **Agent Tesla**, **Formbook**, **Loki**, and **Snake Keylogger**. Researchers said the malware was used to steal credentials, banking and browsing data, and keystrokes, while some samples used fileless execution, anti-analysis checks, and process hollowing to evade detection; one campaign also appeared to target suppliers as a path to compromise trusted downstream business relationships.
Aug 15, 2026
Kaspersky reported that the threat actor **Bloody Wolf**—tracked by the vendor as **Stan Ghouls**—is running a spear-phishing campaign primarily targeting organizations in **Uzbekistan** and **Russia**, with additional, lower-volume activity observed in other countries. The activity, ongoing since at least 2023, has targeted sectors including manufacturing, finance, and IT, and has also been observed hitting government, logistics, healthcare, and education entities. Reported victim counts for the current wave are on the order of **50+ in Uzbekistan** and **~10 in Russia**, with the actor assessed as likely financially motivated, though the heavy use of remote-access tooling may also support espionage objectives. The intrusion chain relies on phishing emails carrying **malicious PDF lures** (e.g., court/government-themed documents) that embed links leading to a downloader/loader, after which the actor deploys **NetSupport RAT** (a legitimate remote administration tool) for remote control—representing a shift from prior use of **STRRAT**. Kaspersky noted the loader’s behavior includes user-deception (fake error messages) and basic execution controls (e.g., limiting repeated installation attempts), while another reported lure uses a social-engineering pretext that victims must install a **Java Runtime Environment update**, ultimately delivering a **malicious JAR**—a technique Kaspersky described as a distinctive fingerprint for this actor. Prior related reporting cited phishing activity in Kyrgyzstan distributing similar tooling, indicating a broader regional focus beyond the current Uzbekistan/Russia emphasis.
Jun 29, 2026
Cavalry Werewolf, an advanced persistent threat (APT) group with reported overlaps to YoroTrooper and other clusters such as SturgeonPhisher, Silent Lynx, Comrade Saiga, ShadowSilk, and Tomiris, has been actively targeting Russian state agencies and critical industries. The group has been observed deploying custom malware families, notably FoalShell and StallionRAT, in a series of sophisticated cyberattacks. According to cybersecurity vendor BI.ZONE, the attackers initiated their campaigns by sending highly targeted phishing emails that masqueraded as official correspondence from Kyrgyz government officials. These emails were crafted to deceive recipients within Russian government agencies, as well as organizations in the energy, mining, and manufacturing sectors. In some instances, the attackers compromised legitimate email accounts belonging to the Kyrgyz Republic's regulatory authority, increasing the credibility and effectiveness of their phishing attempts. The phishing emails typically contained RAR archive attachments, which, when opened, delivered the FoalShell or StallionRAT malware payloads to the victims' systems. FoalShell is a lightweight reverse shell available in Go, C++, and C# versions, enabling attackers to execute arbitrary commands via cmd.exe on compromised machines. StallionRAT, written in Go, PowerShell, and Python, provides similar capabilities, including command execution, file loading, and data exfiltration. The campaign was observed between May and August 2025, indicating a sustained and coordinated effort to infiltrate Russian public sector networks. The technical sophistication of the malware, including its multi-language implementations, suggests a well-resourced and adaptable threat actor. The use of Telegram as a command-and-control (C2) channel has also been reported, allowing the attackers to maintain covert communications and control over infected hosts. The group’s ties to Tomiris, which Microsoft has linked to a Kazakhstan-based actor known as Storm-0473, further suggest a regional nexus and possible state sponsorship. Previous related attacks by ShadowSilk targeted government entities in Central Asia and the Asia-Pacific region, using similar remote access trojans and reverse proxy tools. The ongoing campaign highlights the persistent threat posed by Cavalry Werewolf to Russian governmental and industrial targets, as well as the broader regional implications of their operations. Security researchers emphasize the importance of monitoring for phishing attempts impersonating government officials and the deployment of custom malware families like FoalShell and StallionRAT. The attacks underscore the need for robust email security, user awareness training, and advanced endpoint detection to mitigate the risk from such sophisticated APT campaigns. The incident also demonstrates the evolving tactics of threat actors in leveraging both social engineering and technical innovation to achieve their objectives. Organizations in the targeted sectors are advised to review their security postures and implement proactive threat hunting measures. The campaign serves as a reminder of the complex and dynamic nature of cyber threats facing government and critical infrastructure entities in the region.
Jun 29, 2026