Cybercriminals Target Central Asia's Critical Infrastructure Amid Rising Threats

Introduction

In early 2026, Central Asia has witnessed a surge in cybercriminal activities targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks have escalated the threat landscape, necessitating immediate attention and robust cybersecurity measures.

Recent Cybercriminal Activities

In May 2025, Kazakhstan experienced a large-scale Distributed Denial of Service (DDoS) attack that disrupted online services across government portals, banking systems, and telecommunications networks. The attack overwhelmed servers with excessive traffic, rendering critical digital infrastructure inaccessible for thousands of users. This incident highlights the vulnerability of Kazakhstan's digital infrastructure to cybercriminal activities. (timesca.com)

Additionally, in November 2025, the Caspian Pipeline Consortium (CPC), a vital energy infrastructure in Kazakhstan, was targeted by naval drone attacks. The assault led to the temporary suspension of shipments and the shift to operating through a single remote mooring facility, significantly impacting Kazakhstan's economy. This attack underscores the potential for cybercriminals to exploit physical and digital vulnerabilities in critical infrastructure. (timesca.com)

Emerging Threats and Tactics

Cybercriminal groups are increasingly targeting ICS and SCADA systems, which are integral to the operation of critical infrastructure. The hacktivist group Cyber Army of Russia Reborn (CARR) has been identified as exploiting vulnerabilities in ICS environments, including water and wastewater systems, food and agriculture, and energy sectors. CARR has employed basic methods to access SCADA networks and, in some cases, conducted simultaneous DDoS attacks. The group utilizes internet-scraping tools like Nmap and OPENVAS to identify visible Virtual Network Computing (VNC) services and employs brute-force password spraying techniques to gain access. (ics-cert.kaspersky.com)

The development of sophisticated malware targeting ICS further exacerbates the threat. Malware frameworks such as Pipedream (also known as Incontroller) have been designed to compromise programmable logic controllers (PLCs) and ICS devices. These tools enable cybercriminals to scan for, compromise, and control specific ICS/SCADA devices, posing significant risks to critical infrastructure operations. (en.wikipedia.org)

Implications for Central Asia

The increasing frequency and sophistication of cybercriminal attacks on critical infrastructure in Central Asia have profound implications for national security and economic stability. Disruptions in power grids, water systems, and healthcare facilities can lead to widespread societal impacts, including public health crises and economic downturns. The financial sector is also at risk, with potential breaches leading to significant financial losses and erosion of public trust.

Recommendations

To mitigate these threats, it is imperative for Central Asian nations to:

• Enhance Cybersecurity Measures: Implement robust cybersecurity protocols to protect ICS and SCADA systems from unauthorized access and attacks.

• Conduct Regular Vulnerability Assessments: Perform comprehensive assessments to identify and address potential vulnerabilities in critical infrastructure systems.

• Promote International Collaboration: Engage in information sharing and collaborative efforts with international partners to strengthen collective defense against cybercriminal activities.

• Invest in Cybersecurity Training: Provide ongoing training for personnel to recognize and respond effectively to cyber threats.

Conclusion

The threat of cybercriminal attacks on critical infrastructure in Central Asia is escalating, with significant risks to national security and economic stability. Proactive measures, including enhanced cybersecurity protocols, regular vulnerability assessments, international collaboration, and continuous training, are essential to safeguard critical infrastructure and ensure the resilience of the region's digital and physical assets.

Highlights:

• Latvia's security service says 2 people set fire to a train and rail equipment for Russia, Published on Thursday, March 12
• Iran-linked hackers take aim at US and other targets, raising risk of cyberattacks during war, Published on Thursday, March 12