Hacktivist Cyber Espionage in Central Asia: A Rising Threat

Introduction

In recent years, Central Asia has witnessed a surge in cyber espionage activities attributed to hacktivist groups. These actors employ sophisticated techniques, including long-term implants and supply chain compromises, to infiltrate systems and collect sensitive information. This briefing examines the current threat landscape, focusing on notable operations and their implications.

Golden Falcon Group: A Case Study

The Golden Falcon Group, also known as DustSquad or APT-C-34, has been active since 2014. Initially operating as a state-sponsored espionage unit, the group transitioned to a hacktivist collective in late 2024, aligning with pro-Russian and pro-Palestinian agendas. Their operations have primarily targeted Kazakhstan, employing sophisticated tools like the Octopus backdoor and RCS implants. Notably, in 2024, they synchronized DDoS and ICS attacks with geopolitical events, such as the Ukraine conflict, highlighting their strategic approach to cyber operations. (orangecyberdefense.com)

Supply Chain Compromise and SIGINT-Linked Intrusions

Hacktivist groups have increasingly targeted supply chains to gain access to sensitive information. For instance, in early 2025, the UAC-0063 group, linked to Russian state-backed APT28, exploited trojanized documents from Kazakhstan's Ministry of Foreign Affairs. These documents, related to diplomatic cooperation, were weaponized to deliver Hatvibe and CherrySpy malware, facilitating intelligence collection on Kazakhstan's international relations. (scworld.com)

Additionally, in late 2025, the Chinese-linked threat operation UNC6384, associated with APT29, targeted European diplomatic entities using spear-phishing emails. These emails contained malicious LNK files exploiting a Windows zero-day vulnerability, leading to the deployment of the PlugX remote access trojan. While primarily targeting European diplomats, the techniques employed are relevant to Central Asian entities, given the region's diplomatic engagements. (bleepingcomputer.com)

Diplomatic Targeting and Geopolitical Implications

Hacktivist groups often target diplomatic entities to influence geopolitical narratives. The Golden Falcon Group's shift to hacktivism in 2024 underscores this trend, as they aim to amplify global conflicts through cyber means. Their attacks on critical infrastructure in countries like France and the United States serve as retaliatory measures against foreign policies, demonstrating the convergence of cyber espionage and ideological warfare. (orangecyberdefense.com)

Conclusion

The evolving tactics of hacktivist groups in Central Asia, characterized by long-term implants, supply chain compromises, and SIGINT-linked intrusions, pose a significant threat to regional stability. Their operations are increasingly sophisticated, often synchronized with geopolitical events to maximize impact. Stakeholders in Central Asia must enhance their cybersecurity posture, focusing on supply chain security and diplomatic communications, to mitigate these emerging threats.

Highlights:

• New APT28-linked cyberespionage campaign aimed at Central Asia | brief | SC Media, Published on Monday, January 13
• Windows zero-day actively exploited to spy on European diplomats, Published on Thursday, October 30
• GoldenFalcon Group, Published on Wednesday, February 11