Fancy Bear spotted using real Kazak government documents in spearpishing campaign

Sekoia researchers observed a Russian-linked espionage campaign dubbed "Double-Tap" that weaponizes apparently legitimate Kazakhstan government documents as Word-based phishing lures; the macro chain downgrades security settings, deploys a loader called HATVIBE which fetches the CHERRYSPY backdoor, and sets persistence to run periodically. The activity—linked with medium confidence to APT28/Fancy Bear and overlapping with ZEBROCY—has impacted targets across Central Asia, East Asia and Europe, and includes documented compromises (e.g., a Tajikistan embassy email) and indicators/detection guidance published by researchers.