Hacktivist Attacks on Central Asia's Critical Infrastructure: A Rising Threat

Executive Summary

In recent years, hacktivist groups have escalated cyberattacks on critical infrastructure across Central Asia, including power grids, water systems, industrial control systems (ICS), healthcare facilities, and financial sectors. These attacks have led to significant disruptions, data breaches, and potential threats to public safety. This briefing examines the current threat landscape, identifies key threat actors, and provides recommendations for mitigating these risks.

Current Threat Landscape

Hacktivism in Central Asia has evolved from traditional cyberattacks, such as distributed denial-of-service (DDoS) campaigns and website defacements, to more sophisticated intrusions targeting critical infrastructure. Notably, in May 2025, Kazakhstan experienced a large-scale DDoS attack that disrupted online services across government portals, banking systems, and telecommunications networks. This attack overwhelmed servers with excessive traffic, rendering essential digital infrastructure inaccessible for thousands of users. (timesca.com)

In addition to DDoS attacks, there has been a concerning trend of hacktivist groups targeting ICS and SCADA systems. These systems are integral to the operation of critical infrastructure, including power grids and water treatment facilities. The compromise of such systems can lead to operational disruptions and pose significant risks to public safety. For instance, in 2024, the hacktivist group Cyber Army of Russia Reborn (CARR) claimed responsibility for manipulating water storage tanks in the United States, leading to the loss of tens of thousands of gallons of water. (levelblue.com)

Key Threat Actors

Several hacktivist groups have been identified as active in targeting critical infrastructure in Central Asia:

• Cyber Army of Russia Reborn (CARR): A pro-Russian hacktivist group known for targeting critical infrastructure in various countries. In 2024, CARR manipulated water storage tanks in the United States, leading to significant water loss. (levelblue.com)

• Anonymous Sudan: A hacker group active since 2023, alleged to have conducted over 35,000 DDoS attacks against various targets, including government agencies and critical infrastructure. While their primary focus has been on perceived anti-Muslim activities, their operations have had broader implications. (en.wikipedia.org)

• NoName057(16): A hacktivist group that has executed multiple DDoS attacks against critical infrastructure during high-level political events. In July 2025, a coordinated effort by multiple countries led to the takedown of NoName057(16), which had been responsible for attacks targeting power suppliers and public transport across Europe. (eurojust.europa.eu)

Impact on Critical Infrastructure

The activities of these hacktivist groups have had significant impacts on critical infrastructure in Central Asia:

• Power Grids: Cyberattacks targeting power grids can lead to widespread outages, affecting both residential and industrial sectors. The 2015 Ukraine power grid hack serves as a stark reminder of the potential consequences of such attacks. (en.wikipedia.org)

• Water Systems: Manipulation of water treatment facilities can result in contamination or disruption of water supply, posing public health risks. The CARR's attack on water storage tanks in the U.S. highlights the potential for such incidents. (levelblue.com)

• Healthcare Facilities: Cyberattacks on healthcare systems can compromise patient data, disrupt medical services, and delay critical care. The increasing sophistication of these attacks underscores the need for robust cybersecurity measures in the healthcare sector.

• Financial Sector: Disruptions to banking systems can lead to financial losses, erode public trust, and destabilize economies. The DDoS attack in Kazakhstan serves as an example of how such attacks can cripple financial operations. (timesca.com)

Recommendations

To mitigate the risks posed by hacktivist attacks on critical infrastructure, the following measures are recommended:

1. Enhanced Cybersecurity Protocols: Implement robust security measures, including regular system updates, intrusion detection systems, and multi-factor authentication, to protect critical infrastructure.

2. Incident Response Planning: Develop and regularly update incident response plans to ensure swift and effective responses to cyberattacks.

3. Public Awareness and Training: Conduct regular training for personnel to recognize and respond to cyber threats, and raise public awareness about the importance of cybersecurity.

4. International Collaboration: Engage in information sharing and collaborative efforts with international partners to identify and counteract cyber threats.

Conclusion

The escalation of hacktivist attacks on critical infrastructure in Central Asia presents a significant threat to national security and public safety. Proactive measures, including enhanced cybersecurity protocols, comprehensive incident response planning, and international collaboration, are essential to mitigate these risks and safeguard critical infrastructure.

Recent Developments in Hacktivist Attacks on Critical Infrastructure:

• Hacktivist group responsible for cyberattacks on critical infrastructure in Europe taken down | Eurojust | European Union Agency for Criminal Justice Cooperation, Published on Tuesday, July 15
• Ongoing DDoS Attack Disrupts Kazakhstan’s Digital Infrastructure - The Times Of Central Asia, Published on Tuesday, May 06
• The Russia-Ukraine Cyber War Part 3: Attacks on Telecom and Critical Infrastructure, Published on Tuesday, March 04