Russia Targets Kazakhstan in Espionage Campaign

Hackers possibly from the Russian Main Intelligence Directorate have been spying on neighboring Kazakhstan using legitimate government documents that have been booby-trapped with a malicious macros. The latest campaign, dubbed “Double-Tap,” emerged in October 2024.

See Also: Live Webinar | The Perfect Target: How Cybercriminals Use AI to Create Advanced Phishing Attacks

Researchers at Sekoia attributed the campaign to group tracked as UAC-0063, first named by Ukrainian cyber defenders in April 2023.

The Ukrainian government computer emergency response team assessed with medium confidence that UAC-0063 overlaps with a Russian intelligence group often tagged as APT 28, which is linked to Unit 26165 of the Russian Main Intelligence Directorate. Both CERT-UA and Recorded Future have connected UAC-0063 to APT28, citing medium confidence based on technical similarities.

UAC-0063’s hacking objectives align with Kremlin priorities of gathering economic and political intelligence from diplomatic, academic and defense sources. Sekoia dubbed this campaign “Double-Tap” because the two-step process begins with the execution of a macro in a document, which creates another document that uploads malware. Sekoia first identified the campaign in October 2024 when its trackers found malicious documents on VirusTotal.

Researchers traced the files, which were disguised as official correspondence and draft diplomatic statements, to the Ministry of Foreign Affairs of Kazakhstan. Examples of the phishing lures included a draft joint statement involving Germany and Central Asian leaders and diplomatic letters exchanged with embassies in Afghanistan and Belgium. These documents, authentic but altered with malicious macros, compromise hosts once opened.

The infection chain then deploys Hatvibe and Cherryspymalware. The process begins when a malicious macro embedded in a legitimate document prompts users to execute it. This action alters security settings, bypasses macro execution prompts and creates additional malicious documents.

These documents execute hidden tasks, deploying malware to exfiltrate data and establish persistence.

Hatvibe is a VBS-based backdoor that communicates with a remote command-and-control server to receive encrypted modules for execution. Its unique infection chain employs security evasion techniques such as hiding malicious code in document settings and creating scheduled tasks without using conventional tools like schtasks.exe. Cherryspy complements Hatvibe by extending data collection capabilities.

One malicious document analyzed by researchers used a macro to create additional files and drop a hidden HTML Application file containing Hatvibe. This file established a persistent backdoor by scheduling repeated execution of its code, enabling continuous data exfiltration.

Sekoia said it identified 18 weaponized documents, including administrative notes, diplomatic letters and intergovernmental reports. One file, unrelated to Kazakhstan’s foreign ministry, originated from Kyrgyzstan’s defense ministry, reflecting broader targeting across Central Asia. The documents spanned from 2021 to 2024, indicating a sustained effort to infiltrate regional networks.