Researchers link hackers targeting Russian refinery and city government to Kazakhstan

A hacking group researchers call Silent Lynx likely operates from Kazakhstan, according to a report on attacks against a Russian oil refinery and a municipal government network earlier in 2026.

In a joint report, Chi-en Shen of Cisco and Julian-Ferdinand Vögele of cybersecurity firm Recorded Future said the group had also hacked government organizations across Central Asia. They said Silent Lynx often used spear-phishing emails, infecting targets with attachments designed to look important.

This is reported by Reuters .

The researchers said the group targeted the Orsk Oil Refinery in southern Russia, which was knocked out for months after a Ukrainian drone attack in August. They also found evidence that the hackers had broken into the Nizhny Novgorod city government network. The city is 425 kilometers (265 miles) east of Moscow.

The Orsknefteorgsintez refinery is 25 kilometers (16 miles) from the Kazakh border. Repeated outages caused by Ukrainian drone attacks have prompted the Russian government to turn to Kazakhstan for refining capacity. Nizhny Novgorod lies where the Volga and Oka rivers meet, upstream of the Caspian Sea, a critical body of water for landlocked Kazakhstan.

Oleg Shakirov, a doctoral student studying cyber policy and conflict at the Johns Hopkins School of Advanced International Studies, said the campaign showed that cyberespionage is not confined to a few major powers.

“The spying was a reminder that the cyberespionage game is not limited to only a few cyber powers,” said Oleg Shakirov. “Other nations are catching up.” – Oleg Shakirov

“The spying was a reminder that the cyberespionage game is not limited to only a few cyber powers,” said Oleg Shakirov. “Other nations are catching up.”

The researchers cited attempts to test the group’s malicious software from Kazakhstan shortly after its code was compiled, as well as activity consistent with Kazakh working hours. They said the campaign also aligned with Kazakhstan’s strategic interests. They found evidence that the hackers compromised a Tajik government agency as Kazakhstan was ratifying a treaty with Tajikistan in early 2026, and that a Belarusian government agency was similarly compromised ahead of an April meeting between Belarusian and Kazakh diplomats.

The Orsk refinery and the Nizhny Novgorod government did not respond to requests for . Attempts to the hackers were unsuccessful. The Kazakh, Russian, Tajik and Belarusian governments also did not respond to requests for .

More interesting materials:

Private cybersecurity firms and allied intelligence warn a Russian hacker group conducted a yearlong cyberespionage campaign against US nuclear fusion researchers, defense contractors, and officials, exploiting rare email server vulnerabilities to steal months of correspondence.

Almaty court sentenced Kazakh citizen Timur Praliev to five years for participating in foreign armed conflicts after recruitment by Russian PMC Wagner to fight against Ukraine.

The EU Council sanctioned 10 people and 17 organizations it considers responsible for the illegal deportation and forced transfer of Ukrainian children to Russia and temporarily occupied Ukrainian territories.