Cybersecurity researchers have reported attacks by the group Silent Lynx, allegedly linked to Kazakhstan, on a Russian oil refinery and a city administration network. According to the researchers, the cyber-espionage campaign also affected government organisations in Central Asia and other countries in the region.
WHAT IS KNOWN ABOUT THE ATTACKS
According to Reuters, citing a joint report by specialists from Cisco and the company Recorded Future, the Silent Lynx group attacked the Orsk oil refinery in Russia's Orenburg region. The researchers also found signs of penetration into the network of the Nizhny Novgorod administration.
The report states that the hackers are probably based in Kazakhstan. However, their identities and affiliation with any government structures have not been established.
HOW THE GROUP OPERATED
According to the researchers, Silent Lynx used targeted phishing — sending emails with attachments that appear important and prompt the recipient to open a malicious file.
Researchers cite several indicators in support of the group's possible link to Kazakhstan: attempts to check malicious software from the country's territory shortly after the code was compiled, as well as activity consistent with local working hours.
WHICH ORGANISATIONS MAY HAVE BEEN AFFECTED
In addition to Russian targets, the researchers found signs of compromise of government organisations in other countries. In particular, according to their data, the attackers gained access to a government agency in Tajikistan in early 2026, when Kazakhstan ratified a treaty with that country.
The researchers also reported the compromise of a Belarusian government agency ahead of a meeting of diplomats from Belarus and Kazakhstan in April 2026.
According to the report's authors, the timing of these episodes and the nature of the activity may correspond to Kazakhstan's strategic interests.
WHY THE ATTACKS DREW ATTENTION
The Orsk oil refinery is located approximately 25 km from the border with Kazakhstan. In August 2025, the facility was attacked by Ukrainian drones, after which its operations were disrupted for several months. Amid repeated disruptions, the Russian authorities turned to Kazakhstan for additional oil refining capacity.
Nizhny Novgorod is located approximately 425 km east of Moscow, upstream on the Volga and Oka. The regional location of these facilities and the possible links between the attacks and events in neighbouring countries drew researchers' attention to the geography of the campaign.
HOW THE AUTHORITIES REACTED
Reuters reported that the Russian, Kazakh, Tajik and Belarusian authorities did not respond to requests for comment. Representatives of the Orsk oil refinery and the Nizhny Novgorod administration also did not provide comments. It was not possible to contact the alleged participants in the attacks.
CONTEXT
In September 2026, the hacker group DATASUCKERS claimed an attack on Dodo Pizza and the acquisition of data on millions of customers, including from Kazakhstan. According to the hackers, this involved approximately 68 million people worldwide, including 6.7 million Kazakhstanis. The company did not confirm these figures.
FBRK contacted members of the group and found out how they choose their targets, to whom they sell stolen databases and why Kazakhstan does not yet represent a separate interest for them.
What happens to personal data after a hack? Why do hackers claim they do not support fraud but sell other people's information themselves? What do they know about the possible eGov hack and who is behind the group itself?
Read the details of the interview on the FBRK website.
Watch the full breakdown on YouTube.
