State-Sponsored Cyber Operations Targeting Central Asia: A 2026 Assessment

Introduction

As of April 2026, Central Asia has become a focal point for state-sponsored cyber operations. Advanced Persistent Threat (APT) groups, often linked to nation-states, are increasingly targeting the region's critical infrastructure, government entities, and private sectors. This briefing examines recent activities, identifies key threat actors, and assesses the region's vulnerabilities.

Recent Cyber Operations in Central Asia

In late 2024, the APT group known as Silent Lynx initiated "Operation Peek-a-Baku," deploying phishing campaigns themed around regional diplomatic events. These campaigns delivered malicious attachments to government entities, financial institutions, and critical infrastructure sectors across Tajikistan, Kazakhstan, Kyrgyzstan, Turkmenistan, and Uzbekistan. The group's tactics included embedding malware within legitimate services, such as Google Drive and Windows Update, to evade detection. (hivepro.com)

Additionally, in 2020, an APT group believed to be state-sponsored infiltrated networks of a telecommunications company, a gas company, and a governmental institution in Central Asia. The attackers planted backdoors to maintain long-term access, monitoring operations and gathering sensitive information. (blog.avast.com)

Key Threat Actors

Several APT groups have been identified as active in the region:

• Silent Lynx: Also known as YoroTrooper, Sturgeon Phisher, Cavalry Werewolf, and ShadowSilk, this group has been conducting sophisticated espionage campaigns across Central Asia since late 2024. (hivepro.com)

• FontGoblin: A China-aligned APT group active since at least 2022, targeting government entities in Kyrgyzstan, Uzbekistan, Kazakhstan, and Pakistan. (eset.com)

• FontFunkyGorillas: Another China-aligned APT group targeting various sectors in Eastern Europe and Central Asia, utilizing the Zmm backdoor and the Trochilus RAT. (eset.com)

Tactics, Techniques, and Procedures (TTPs)

State-sponsored APT groups employ a range of sophisticated TTPs:

• Phishing Campaigns: Disguised as official communications, these campaigns deliver weaponized documents or links to gain initial access. (techradar.com)

• Exploitation of Legitimate Services: Embedding malware within trusted platforms like Google Drive and Windows Update to evade detection. (techradar.com)

• Supply Chain Attacks: Injecting malicious code into software updates or supply chain processes to compromise multiple targets simultaneously. (asec.ahnlab.com)

Regional Vulnerabilities

Central Asia's rapid digitalization has outpaced public digital literacy, creating an environment where cybercriminals exploit unprepared populations and weak institutional defenses. This digital vulnerability is exacerbated by limited cybersecurity infrastructure and a lack of coordinated regional response mechanisms. (anspistrategist.org)

Conclusion

The threat landscape in Central Asia is evolving, with state-sponsored APT groups increasingly targeting the region's critical infrastructure and institutions. To mitigate these threats, it is imperative for Central Asian nations to invest in robust cybersecurity measures, enhance public digital literacy, and foster regional cooperation to strengthen collective defense against cyber adversaries.

Highlights:

• Chinese hackers hide malware within Windows and Google Drive to hit government targets, Published on Thursday, March 05
• Cloudflare warns state-backed hackers are 'weaponizing legitimate enterprise ecosystems' as 'living off the land' attacks surge, Published on Wednesday, March 04