State-Sponsored Cyber Operations in Central Asia: A 2026 Assessment

As of March 2026, Central Asia remains a focal point for state-sponsored cyber operations, with various Advanced Persistent Threat (APT) groups targeting governmental institutions, critical infrastructure, and private enterprises. These activities are primarily driven by geopolitical interests, aiming to gather intelligence, disrupt operations, and maintain regional influence.

Chinese State-Sponsored Activities

Chinese APT groups have been notably active in Central Asia, employing sophisticated tactics to infiltrate networks. In mid-2024, a Chinese state-sponsored hacker group named Silver Dragon, possibly linked to APT41, targeted government entities in Southeast Asia and Europe. Their custom malware, GearDoor, utilized Google Drive for command-and-control communications, allowing them to blend malicious activities with regular file transfers. (techradar.com)

In June 2025, the threat actor known as Bloody Wolf launched cyberattacks against Kyrgyzstan, impersonating the Kyrgyz Ministry of Justice. By distributing malicious Java Archive (JAR) files through official-looking PDF documents, they deployed the NetSupport Remote Access Trojan (RAT) to establish persistent access to targeted systems. (cncso.com)

Russian State-Sponsored Activities

Russian-aligned APT groups have also been active in the region. In January 2025, UAC-0063, linked to Russian state-backed threat operation APT28, conducted a cyberespionage campaign targeting Central Asian diplomatic entities. They leveraged trojanized documents from Kazakhstan's Ministry of Foreign Affairs to distribute malware strains like Hatvibe and Cherryspy, aiming to gather strategic and economic intelligence. (scworld.com)

Additionally, the Russia-aligned threat group TAG-110 has been identified targeting organizations in Central Asia, East Asia, and Europe. Utilizing custom malware tools such as HATVIBE and CHERRYSPY, TAG-110 primarily attacks government entities, human rights groups, and educational institutions, aligning with Russian geopolitical interests. (recordedfuture.com)

Operational Tactics and Tools

State-sponsored APT groups in Central Asia employ a range of tactics and tools to achieve their objectives:

• Phishing Campaigns: Disguised as legitimate communications, these campaigns deliver malicious payloads to gain initial access.

• Exploitation of Vulnerabilities: Targeting unpatched systems and software to infiltrate networks.

• Custom Malware Deployment: Utilizing bespoke tools like GearDoor, Hatvibe, and Cherryspy for data exfiltration and system control.

• Use of Legitimate Services: Employing trusted platforms, such as Google Drive, to mask command-and-control communications and evade detection.

Geopolitical Implications

The cyber activities in Central Asia reflect broader geopolitical dynamics:

• Influence and Control: State-sponsored cyber operations are used to exert influence over neighboring countries and maintain strategic advantages.

• Espionage and Intelligence Gathering: Targeting governmental and critical infrastructure entities to acquire sensitive information.

• Regional Stability: Persistent cyberattacks can destabilize economies and erode public trust in institutions, affecting regional stability.

Conclusion

As of March 2026, state-sponsored cyber operations in Central Asia are characterized by sophisticated tactics and tools, with Chinese and Russian APT groups being particularly active. These operations have significant implications for regional security and geopolitical relations. Continuous monitoring and enhanced cybersecurity measures are essential to mitigate the risks associated with these evolving threats.