Cyber Espionage Threatens Central Asia: APT Groups Targeting Government and Corporate Sectors

Introduction

In early 2026, Central Asia has experienced a surge in cyber espionage activities, with advanced persistent threat (APT) groups targeting both governmental and corporate entities. These operations aim to infiltrate critical infrastructure, steal sensitive information, and disrupt operations, posing significant risks to national security and economic stability.

APT Groups Targeting Central Asia

Several APT groups have been identified as active in the region:

• UAC-0063: This cyber espionage operation has expanded from Central Asia into European countries, employing sophisticated tactics to infiltrate high-value targets, including government entities and diplomatic missions. (bitdefender.com)

• Sandworm: A Russian-speaking APT group, Sandworm has been involved in destructive campaigns in Ukraine, deploying data-wiping malware through the exploitation of network devices and public-facing applications. (ics-cert.kaspersky.com)

• RomCom: This group has been observed distributing shellcode loaders via spear-phishing campaigns, targeting sectors such as energy, defense, pharmaceuticals, chemicals, logistics, manufacturing, food, retail, ICT, ISP, finance, and cybersecurity. (ics-cert.kaspersky.com)

Tactics and Techniques

The APT groups employ a range of sophisticated tactics to achieve their objectives:

• Spear-Phishing: Personalized emails containing malicious links or attachments are used to gain initial access.

• Exploitation of Vulnerabilities: Targeting misconfigured network devices and public-facing applications to deploy malware.

• Credential Theft: Utilizing stolen credentials to bypass security measures and maintain access.

• Data Exfiltration: Stealing sensitive information, including intellectual property and government data.

Impact on Central Asia

The cyber espionage activities have had several notable impacts on the region:

• Governmental Disruption: Compromise of government departments and ministries, including those related to trade, natural resources, border control, and diplomacy. (independent.co.uk)

• Economic Consequences: Disruption of critical infrastructure and industries, leading to financial losses and operational challenges.

• Geopolitical Tensions: Increased cyber activities have heightened regional tensions, potentially affecting international relations and security dynamics.

Recommendations for Mitigation

To address the growing threat of cyber espionage in Central Asia, the following measures are recommended:

• Enhanced Cyber Defense: Implement robust cybersecurity protocols, including regular system updates, intrusion detection systems, and employee training on phishing attacks.

• International Collaboration: Engage in information sharing and joint defense initiatives with neighboring countries and international organizations.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and effective reactions to cyber incidents.

Conclusion

The escalation of cyber espionage activities in Central Asia underscores the need for heightened vigilance and proactive measures. By understanding the tactics employed by APT groups and implementing comprehensive defense strategies, nations in the region can better safeguard their critical infrastructure and sensitive information.

Highlights:

• UAC-0063: Cyber Espionage Operation Expanding from Central Asia, Published on Tuesday, February 11
• APT and financial attacks on industrial organizations in Q4 2025 | Kaspersky ICS CERT, Published on Thursday, March 05
• Asian cyber-spy group breached 37 foreign governments as US works to patch vulnerabilities across agencies: report | The Independent, Published on Wednesday, February 04