Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign
A fresh round of attacks against Kazakhstan's energy sector has been linked to a threat actor, potentially of Russian origin.
Operation BarrelFire, the codename for the operation, is associated with a new threat organization that Seqrite Labs is tracking as Noisy Bear. Since at least April 2025, the threat actor has been active.
According to security researcher Subhajeet Singha, the campaign is directed at KazMunaiGas or KMG employees. The threat entity sent a phony document pertaining to the KMG IT department, imitating official internal communications and utilizing themes like policy updates, internal certification processes, and pay adjustments.
A phishing email with a ZIP attachment that contains a Windows shortcut (LNK) downloader, a phony KazMunaiGas document, and a README....