Hijacking the Hackers: Researchers Sinkhole “KazakRAT” Espionage Campaign

KazakRAT is a minimally obfuscated Windows DLL-based Remote Access Trojan discovered by researchers that has been used since at least August 2022 to target Kazakh and Afghan government and financial entities via malicious MSI installers and decoy documents; unencrypted HTTP C2 beaconing and a lapsed domain (dns.freiesasien.com) were sinkholed to confirm victim IPs and regional targeting in Karaganda, and analysts note tooling overlap with APT36 though attribution is not definitive.