Tag: downshell

1 Attack Reports | 0 Vulnerabilities

Attack reports

Operation BarrelFire: Targeting Kazakhstan Oil & Gas

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025. The campaign focuses on KazMunaiGas employees, using spear-phishing emails with malicious attachments. The infection chain involves a ZIP file containing a malicious LNK file and decoy document, whi…
powershell
infrastructure
spear-phishing
kazakhstan
central asia
russian threat actor
dll injection
amsi bypass
oil and gas
2025-09-04
2025-09-05
downshell
Published: September 5, 2025
Downloadable IOCs: 14
Click here to see more Attack Reports