SecuriTricks - central asia

Deobfuscating APT28's HTA Trojan: A Deep Dive into VBE Techniques & Multi-Layer Obfuscation

This analysis delves into APT28's cyber espionage campaign targeting Central Asia and Kazakhstan diplomatic relations, focusing on their HTA Trojan. The malware employs advanced obfuscation techniques, including VBE (VBScript Encoded) and multi-layer obfuscation. The investigation uses x32dbg debug…

cyber espionage

kazakhstan

central asia

2025-04-04

multi-layer obfuscation

vbe techniques

windows script encoder

x32dbg debugging

hta trojan

Published: April 4, 2025

Downloadable IOCs: 0

Cyber Espionage Operation Expanding from Central Asia

An active cyber-espionage campaign by UAC-0063 is targeting organizations in Central Asia and Europe, including government entities and diplomatic missions. The group exploits previously compromised victims by weaponizing exfiltrated documents to deliver HATVIBE malware. They use sophisticated tool…

Published: January 29, 2025

Downloadable IOCs: 0

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

A new threat group dubbed Silent Lynx has been uncovered targeting entities in Kyrgyzstan and neighboring nations. The group, believed to be Kazakhstan-based, employs sophisticated multi-stage attack strategies using ISO files, C++ loaders, PowerShell scripts, and Golang implants. Their campaigns f…

xerox_scan17510875802718752175.exe

kyrgyzstan

resocks

Published: January 21, 2025

Downloadable IOCs: 12

Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations

A cyber espionage campaign targeting Central Asian countries, particularly Kazakhstan's external relations, has been uncovered. The campaign, attributed to the Russia-aligned intrusion set UAC-0063, uses a sophisticated infection chain called Double-Tap to deliver the HATVIBE and CHERRYSPY malware.…

Published: January 13, 2025

Downloadable IOCs: 12

Tag: central asia

Attack reports

Cloud Atlas activity in the first half of 2025: what changed

Operation Peek-a-Baku: Silent Lynx APT Targets Dushanbe with Espionage Campaign

Operation Peek-a-Baku: APT Targets Dushanbe with Espionage Campaign

Operation BarrelFire: Targeting Kazakhstan Oil & Gas

Deobfuscating APT28's HTA Trojan: A Deep Dive into VBE Techniques & Multi-Layer Obfuscation

Cyber Espionage Operation Expanding from Central Asia

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations