Kazakhstan-linked hackers targeted Russian refinery, spied on city government, researchers say

Hackers likely based in Kazakhstan targeted a Russian ​oil refinery and compromised a Russian municipal government network ​earlier this year, researchers said on Wednesday, a ‌rare ​glimpse of cyberespionage being deployed against Moscow from a smaller neighbour.

In a joint report, Chi-en Shen from Cisco and Julian-Ferdinand Vögele of the cybersecurity firm Recorded Future said the ‌hackers -- nicknamed "Silent Lynx" -- were "likely based in Kazakhstan" and had hacked into government organizations across Central Asia. The researchers said Silent Lynx favoured “spear phishing” emails, using important-looking attachments to infect targets unwary enough to open them.

The spying was "a reminder that the cyberespionage game ‌is not limited to only a few cyber powers," said Oleg Shakirov, a doctoral student who studies cyber policy ‌and conflict at the Johns Hopkins School of Advanced International Studies. "Other nations are catching up." The researchers said Silent Lynx targeted the Orsk Oil Refinery in southern Russia, which was knocked out for months after it was hit in a Ukrainian drone attack in August, and that there was evidence ⁠they ​had broken into the government ⁠of Nizhny Novgorod, a city about 425 kilometers (265 miles) east of Moscow.

The mid-sized Orsknefteorgsintez refinery is about 25 kilometers (16 miles) from the Kazakh border; repeated ⁠outages from Ukrainian drone attacks have prompted the Russian government to tap Kazakhstan for refining capacity. Nizhny Novgorod sits at the confluence of ​the Volga and Oka rivers and is upstream of the Caspian Sea, a critical body of water for landlocked ⁠Kazakhstan.

The Orsk refinery and Nizhny Novgorod government did not return messages seeking comment. Attempts to reach the hackers were unsuccessful.

The researchers said evidence for ⁠Silent ​Lynx's Kazakh ties included apparent efforts by the hackers to test their malicious software from Kazakhstan shortly after its code was compiled and activity consistent with Kazakh working hours. The hackers' spy campaign also lined up with Kazakhstan's strategic ⁠interests, the researchers said. For example, they said they found evidence that the hackers had compromised a Tajik government agency just ⁠as Kazakhstan was ratifying a treaty ⁠with Tajikistan in early 2026, as well as evidence that a Belarusian government agency was similarly compromised ahead of a meeting between diplomats from Belarus and Kazakhstan in April.

The Kazakh, ‌Russian, Tajik and ‌Belarusian governments did not return messages seeking comment.