Kazakhstan-Linked Hackers Target Russian Oil Refinery and Government

• •Silent Lynx hackers likely operate from Kazakhstan, targeting Russian infrastructure.
• •Spear-phishing tactics were used to compromise the Orsk Oil Refinery and Nizhny Novgorod government.
• •The attacks coincide with Kazakhstan's strategic interests in the region.

Researchers identified a hacking group named Silent Lynx, likely based in Kazakhstan, that targeted the Orsk Oil Refinery and the Nizhny Novgorod city government in Russia. The group employed spear-phishing tactics, using seemingly important attachments to compromise their targets. The Orsk refinery had already been affected by a Ukrainian drone attack in August 2026, which led to significant operational disruptions. Evidence suggests that the hackers' activities aligned with Kazakhstan's strategic interests, including compromises of Tajik and Belarusian government agencies during key diplomatic events. The attacks highlight the growing capabilities of smaller nations in cyberespionage. Both the refinery and city government did not respond to inquiries regarding the attacks. The researchers noted that the group’s operations were consistent with Kazakh working hours and included attempts to test malware from Kazakhstan shortly after its creation.