Overview
Russian threat actor UAC-0063 demonstrates sophisticated capabilities in targeting Kazakhstan through a multi-stage cyber espionage campaign. The attacks leverage stolen diplomatic documents and deploy HATVIBE, CHERRYSPY, and STILLARCH
Whom it may concern
- Government agencies handling diplomatic communications
- Critical infrastructure organizations in Central Asia
- Cybersecurity teams monitoring APT activities
- Organizations vulnerable to spear-phishing attacks
Key Findings
- Technical sophistication demonstrated through Double-Tap infection chain using Microsoft Office macros
- Expansion of SORM surveillance platform across 8+ countries
- Compromised diplomatic documents used as spear-phishing lures
- Strong attribution evidence linking campaign to APT28/GRU
Risk Analysis
- Probability: High (Based on observed campaign intensity)
- Impact: Critical (Access to diplomatic communications)
- Attribution Confidence: Medium to High
- Campaign Scope: Multiple sectors including government, energy, and defense
Action Items
- Implement macro security controls and HTA execution restrictions
- Deploy enhanced email filtering for diplomatic communications
- Review and update incident response procedures
- Monitor for HATVIBE and CHERRYSPY indicators
Sources
- [The Hacker News](https://thehackernews.com/2025/01/russian-linked-hackers-target.html)
