---
title: Russian Hackers Target Kazakhstan's State Oil Giant in Espionage Campaign
description: Russia-linked hackers target KazMunayGas with phishing attacks, exploiting geopolitical tensions to establish hidden access for espionage.
canonical_url: https://codekeeper.co/ticker/noisy-bear-targets-kazmunaygas-phishing-attack
---

# Russian Hackers Target Kazakhstan's State Oil Giant in Espionage Campaign

Russia-linked hackers target KazMunayGas with phishing attacks, exploiting geopolitical tensions to establish hidden access for espionage.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 11, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A Russia-linked hacking group dubbed "Noisy Bear" has targeted KazMunayGas, Kazakhstan's state-owned oil company and the country's largest corporation. The attackers used phishing emails disguised as urgent company business to trick employees into downloading malware that established hidden access to company systems. The hackers compromised a finance department email account and sent fake messages about salary schedules and corporate policy changes. Their sophisticated malware bypassed Windows security features and created covert backdoors for long-term espionage. While KMG claims this was just a security exercise, researchers found evidence linking the attack to sanctioned Russian hosting providers. The timing is significant as European countries seek alternatives to Russian energy amid ongoing geopolitical tensions. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/russian-apt-kazakhstan-largest-oil-company)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnoisy-bear-targets-kazmunaygas-phishing-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Ransomware Attack Shuts Down Evanston Township High School Aug 12, 2026](https://codekeeper.co/ticker/ransomware-attack-evanston-high-closure)

[Phishing Scam Poses as Big Brands to Steal Google Credentials from Marketing Pros Aug 12, 2026](https://codekeeper.co/ticker/phishing-campaign-targets-marketers-via-brands)

[Cyberattacks Chrome Zero-Day Exploit Spread to Four Spy Groups Within Days Sep 10, 2026](https://codekeeper.co/ticker/bluemoon-exploit-kit-targets-chrome-windows)

[Coordinated Cyberattack Hits 30+ Minnesota Water Utilities Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack-july-2023)