[Stanley]

Noisy Bear Campaign Targeting Kazakhstan Energy Sector Outed as a Planned Phishing T

A threat actor possibly of Russian origin has been attributed to a new set of attacks targeting the energy sector in Kazakhstan.
The activity, codenamed Operation BarrelFire, is tied to a new threat group tracked by Seqrite Labs as Noisy Bear. The threat actor has been active since at least April 2025.
"The campaign is targeted towards employees of KazMunaiGas or KMG where the threat entity

https://thehackernews.com/2025/09/noisy-...nergy.html

[The Pact]

Why was the threat actor profile called Noisy Bear?
Apparently KMG is the national leader in the oil and gas industry of Kazakhstan and that's who they targeted. They used phishing emails with the subject line
“URGENT! Review the updated salary schedule.”
which included a ZIP attachments containing a decoy document mimicking internal HR communications and a malicious LNK shortcut named “Salary Schedule.lnk.” Kind of ingeniously evil.

This hacking campaign underscores the growing sophistication of phishing attacks in critical infrastructure sectors. It's kind of a textbook case of infrastructure abuse using phishing.

[Yanix]

Energy companies worldwide should take this as a warning. If it’s happening in Kazakhstan today, it could be somewhere else tomorrow.