Double-Tap: APT28-Linked Espionage on Kazakhstan

This Sekoia report documents an ongoing cyber-espionage campaign (UAC-0063) that weaponized legitimate Kazakhstan Ministry of Foreign Affairs Word documents to deploy a Double-Tap macro chain that installs a VBS backdoor (HATVIBE) and likely a Python backdoor (CHERRYSPY); it includes technical analysis of the infection chain, YARA rules, IOCs (hashes and C2s), detection guidance, and an assessment of medium-confidence links to APT28/GRU and strategic targeting of Central Asian diplomatic and economic intelligence.