Kazakhstan

This page covers cyber threats to Kazakhstan. It brings together official Kazakh texts (the State Technical Service, the Ministry of Artificial Intelligence and Digital Development, the Prosecutor General’s Office, the Security Council and the President), reports of their statements by The Astana Times, Tengrinews, Zakon.kz and Eurasianet, and Brandefense research. Where a source names Kazakhstan, the page says who said it and when.

Threat groups that official sources link to Kazakhstan

No official source we opened (government advisories, EU Council, MITRE ATT&CK group pages for the groups in our library) names Kazakhstan as a target of a group that has a profile in our threat group library. For that reason no group is listed here. Our own research on groups that mention Kazakhstan is in the section below.

Incidents on record

The incidents listed below are the major ones that Kazakh authorities reported or that were widely covered, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

What official figures say

The Prosecutor General’s Office says cybercrime caused 16.4 billion tenge (US$34 million) in damage in the first ten months of 2025, 29 times the 2024 level. The Committee on Legal Statistics registered 201 informatization and communications offenses from January to October 2025, 86.1 percent more than a year earlier. About 80 percent of cases involve theft of personal information. Another 6 percent involve unauthorized access to organizational information systems and 6 percent theft of banking data.

Almaty and Astana recorded the most cases, 39 and 35 (The Astana Times, 1 April 2026). Kazakhstan ranks 47th of 125 countries in the National Cybersecurity Index. A cybersecurity expert cited in the same article puts the country in Tier 2 of the ITU Global Cybersecurity Index 2024, with 94.04 points. In August 2022 the head of the National Security Committee (KNB) told the President that his agency had repelled 295 million cyberattacks and 2,000 DDoS attacks on critical infrastructure since the start of that year (Eurasianet, 3 October 2022).

How attackers target Kazakhstan: Brandefense research

State-linked and regional espionage. Our Silent Lynx post describes an espionage group active against Central Asian governments and banks since late 2024. The post says it likely operates from Kazakhstan and has targeted Kyrgyzstan and Turkmenistan. Attacks start with spear-phishing that carries RAR or ISO attachments, and the group uses staged loaders, PowerShell and Golang implants and Telegram for command and control. Our Mythic Leopard post lists Kazakhstan among the countries the group targeted. It says that in 2012 there were two attacks within minutes of each other on officials at the Indian embassies in Saudi Arabia and Kazakhstan, both by email with a malware attachment.

Ransomware and stealers. Our Medusa analysis says Medusa and its affiliates do not attack CIS countries, and lists Kazakhstan among them. The Top 3 stealer malware report says the Raccoon stealer checks the default user locale of the infected device and does not run if it is one of several countries, Kazakhstan among them.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity. In plain words, Cyber Threat Intelligence is how a security team in Kazakhstan learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins, or a database of personal data, are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

Personal data collection, processing and protection are governed by the law on personal data and its protection. The Ministry of Artificial Intelligence and Digital Development is the authorized body. It handles appeals and can run unscheduled inspections. Violations carry administrative liability and criminal liability under article 147 of the Criminal Code (The Astana Times, 29 July 2025). In December 2023 Kazakhstan adopted a law amending acts on information security, informatization and digital assets, which gave the ministry the authority for state oversight of personal data protection. The President signed a new Digital Code on 9 January 2026.

Under it, service providers must delete or stop processing personal data within 15 days of a request (The Astana Times, February 2026). At the KazHackStan conference in September 2026 the minister said a cybersecurity law has been adopted, personal data requirements have been updated and more than 400 critical facilities are under special control (State Technical Service). On 11 September 2026 the President approved new Security Council regulations whose remit includes information and cybersecurity and personal data protection (The Astana Times, 11 September 2026). Kazakhstan also signed a UN convention on cooperation against digital crime in 2025.

How incident response is organized

The National Information Security Coordination Center was created in 2018 at the State Technical Service, a cybersecurity unit under the KNB, with its powers set in article 7-4 of the Law on Informatization. The national computer incident response service KZ-CERT works within it. The first line of the State Technical Service security operations center tells staff of state bodies about information security events it finds and passes them to KZ-CERT. A consultative coordination council of the center was created on 4 June 2019. After the 2025 leak the Ministry, the KNB and the State Technical Service held a joint inspection, and the Ministry of Internal Affairs says the KNB investigates the criminal case (see the 2025 incident page).

Sectors and rating

The sector table on this page names who said what about each sector. The Ministry told Tengrinews in March 2026 that checks had not confirmed a large-scale leak of citizens’ personal data, that it had analyzed and assessed incidents, and that some checks continue. It declined to name affected servers or bodies, citing restricted information.

The official sources opened give figures on cybercrime cases and the KNB’s count of repelled attacks, but no attack counts by sector. Figures for Kazakhstan will come from Brandefense Atlas.