High-Level Cyber Espionage Campaigns Target Central Asia's Critical Infrastructure

Executive Summary

In early 2026, Central Asia has witnessed a surge in cyber espionage activities, primarily attributed to state-sponsored threat actors. These campaigns have targeted critical infrastructure, government agencies, and industrial sectors, aiming to extract strategic and economic intelligence. Notably, Chinese and Russian advanced persistent threat (APT) groups have been identified as the primary perpetrators.

Chinese State-Sponsored Activities

Chinese APT groups, particularly those affiliated with the Ministry of State Security (MSS), have been active in the region. In mid-2025, the Chinese-speaking group SinisterEye (also known as LuoYu or CASCADE PANDA) conducted cyber espionage operations against both domestic and foreign entities within China. The group's primary method of initial access involved hijacking updates to deliver backdoors such as WinDealer for Windows and SpyDealer for Android. (ics-cert.kaspersky.com)

Additionally, the Chinese-speaking group WARP PANDA has been responsible for long-term, covert intrusions targeting VMware vCenter and ESXi environments at legal, technology, and manufacturing entities based in the USA. Active since at least 2022, WARP PANDA demonstrates advanced operational security and cloud expertise, primarily focusing on data theft. The group deployed a unique malware stack, including BRICKSTORM, a Golang-based backdoor that leverages WebSockets, DNS-over-HTTPS (DoH), and cloud services for stealthy command and control. (ics-cert.kaspersky.com)

Russian State-Sponsored Activities

Russian APT groups, notably APT28 (also known as Fancy Bear), have also been active in the region. In February 2026, APT28 conducted Operation Neusploit, exploiting CVE-2026-21509 in malicious RTF files to target Ukraine, Slovakia, and Romania. The campaign delivered email-stealing and backdoor malware, enabling data theft and remote access. This activity underscores APT28's continued focus on Central and Eastern Europe and its rapid adoption of newly disclosed Microsoft Office vulnerabilities. (cert.europa.eu)

Impact and Implications

The cyber espionage campaigns targeting Central Asia have significant implications for regional security and economic stability. The extraction of sensitive information from critical infrastructure and government entities can lead to strategic disadvantages and potential economic disruptions. The use of sophisticated malware and exploitation of zero-day vulnerabilities by these APT groups highlights the evolving threat landscape and the need for enhanced cybersecurity measures.

Recommendations

• Enhanced Monitoring and Detection: Implement advanced intrusion detection systems to identify and mitigate sophisticated cyber threats.

• Regular Vulnerability Assessments: Conduct periodic security audits to identify and patch vulnerabilities, particularly in widely used software and hardware components.

• International Collaboration: Engage in information sharing and collaborative defense initiatives with international cybersecurity organizations to strengthen collective defense capabilities.

By adopting these measures, organizations in Central Asia can bolster their defenses against ongoing and future cyber espionage activities.