A hacking group called Silent Lynx, believed to be based in Kazakhstan, attacked the Orsk oil refinery in southern Russia and spied on the Nizhny Novgorod administration, Reuters reports, citing a joint report by two researchers: Chi-en Shen of Cisco and Julian-Ferdinand Vögele of cybersecurity firm Recorded Future.
«This is a rare example of cyber espionage against Moscow by a smaller neighbor,» the report says.
The hackers targeted the Orskneftorgsintez refinery in southern Russia, which was knocked out of operation for several months in August after a Ukrainian drone strike. The plant is about 25 kilometers from the Kazakh border. The report adds that the hackers also gained access to the information systems of the Nizhny Novgorod authorities. The city sits at the confluence of the Volga and Oka rivers, upstream from the Caspian Sea, a body of water critical to Kazakhstan.
Silent Lynx, which is likely based in Kazakhstan, has previously hacked government organizations in Central Asian countries. Experts point to several facts that suggest the group has Kazakh roots: the hackers tested malware from Kazakhstan shortly after compiling it, and their activity coincided with working hours in that country. The group's espionage campaign also aligned with Kazakhstan's strategic interests, the researchers say. As examples, they cite the hacking of a Tajik government agency in early 2026, just as Kazakhstan ratified a treaty with Tajikistan, and the compromise of a Belarusian government agency ahead of a meeting between Belarusian and Kazakh diplomats in April.
The governments of Kazakhstan, Russia, Tajikistan and Belarus did not respond to requests for comment. Reuters was also unable to reach the hackers.
According to the researchers, Silent Lynx uses spear phishing, sending emails with attachments disguised as important documents. If a user opens such a file, their device may become infected.
The espionage is a reminder that cyber espionage is not the preserve of the world's leading cyber powers, Reuters quoted Oleg Shakirov, a doctoral student at the Johns Hopkins University School of Advanced International Studies, as saying. «Other countries are also gradually building up their capabilities,» he said.
The report of the hack emerged on the same day that Russian President Vladimir Putin held a meeting in Moscow on strengthening the country's digital security.
