{
  "name": "Hydra Saiga: Covert Espionage and Infiltration of Critical Utilities",
  "slug": "hydra-saiga-covert-espionage-and-infiltration-of-critical-utilities",
  "description": "Hydra Saiga, a suspected Kazakhstani state-sponsored threat actor, has been actively targeting government, energy, and critical infrastructure in Central Asia, Europe, and the Middle East since 2021. The group is known for using Telegram Bot API for C2 communication and employing a mix of custom implants and 'Living off the Land' techniques. Their activities align closely with Kazakhstan's geopolitical interests, particularly in water and energy sectors. The group has compromised at least 34 organizations across 8 countries, with reconnaissance extending to over 200 additional targets globally. Hydra Saiga's operations demonstrate a clear focus on water infrastructure linked to major regional rivers and gas distribution systems, reflecting strategic intelligence collection efforts.",
  "published": "2026-03-17T10:03:35+00:00",
  "created_at": "2026-03-17T10:03:35+00:00",
  "modified_at": "2026-03-17T10:17:04+00:00",
  "created_at_opencti": "2026-03-17T10:03:35+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-17",
    "central asia",
    "critical-infrastructure",
    "custom implants",
    "energy sector",
    "espionage",
    "jlorat",
    "kazakhstan",
    "telegram",
    "telemiris",
    "water resources"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "82.115.223.210"
      },
      {
        "id": "",
        "name": "141.98.82.198"
      },
      {
        "id": "",
        "name": "193.149.129.181"
      },
      {
        "id": "",
        "name": "195.38.162.147"
      },
      {
        "id": "",
        "name": "78.128.112.209"
      },
      {
        "id": "",
        "name": "85.209.128.171"
      },
      {
        "id": "",
        "name": "64.7.198.46"
      },
      {
        "id": "",
        "name": "195.85.115.196"
      },
      {
        "id": "",
        "name": "179.60.150.151"
      },
      {
        "id": "",
        "name": "81.19.136.241"
      },
      {
        "id": "",
        "name": "65.38.121.107"
      },
      {
        "id": "",
        "name": "96.9.125.168"
      },
      {
        "id": "",
        "name": "64.7.198.66"
      },
      {
        "id": "",
        "name": "65.38.120.38"
      },
      {
        "id": "",
        "name": "193.176.182.155"
      },
      {
        "id": "",
        "name": "72.5.43.178"
      },
      {
        "id": "",
        "name": "88.214.26.37"
      },
      {
        "id": "",
        "name": "168.100.11.127"
      },
      {
        "id": "",
        "name": "72.5.43.100"
      },
      {
        "id": "",
        "name": "172.86.75.237"
      },
      {
        "id": "",
        "name": "https://adm-govuz.com/rev.rar"
      },
      {
        "id": "",
        "name": "https://auth.allcloudindex.com/147/sokcs.exe"
      },
      {
        "id": "",
        "name": "https://pweobmxdlboi.com/sokcs.exe"
      },
      {
        "id": "",
        "name": "http://64.7.198.66/resosk443.exe"
      },
      {
        "id": "",
        "name": "https://inbox.mailkeyboard.com/medic/medicru.rar"
      },
      {
        "id": "",
        "name": "https://altaviva.ru/contacts/rsocx.rar"
      },
      {
        "id": "",
        "name": "https://naryncity.kg/minjust.gov.kg/kgnotary.rar"
      },
      {
        "id": "",
        "name": "https://ex.wincorpupdates.com/sokcs.exe"
      },
      {
        "id": "",
        "name": "https://admin.inboxsession.info/teal/ru.rar"
      },
      {
        "id": "",
        "name": "https://www.seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/"
      },
      {
        "id": "",
        "name": "https://france-deguisement.fr/wp-content/samba.exe"
      },
      {
        "id": "",
        "name": "https://ss.qwadx.com/spoolsvc.rar"
      },
      {
        "id": "",
        "name": "https://message.mailboxarea.cloud/steal/ru.exe-"
      },
      {
        "id": "",
        "name": "https://caspiannews.com/news-detail/russia-kazakhstan-sign-memorandum-for-new-cross-border-gas-pipeline-project-2025-10-10-0/"
      },
      {
        "id": "",
        "name": "https://mosreg.docworldme.com/mfa/Central_Asia-Italy_Jeenbek_Kulubaev_working-visit-to-Italy.rar"
      },
      {
        "id": "",
        "name": "a44827d002d7d1a74963b80e6af8a7257977f44c89caff66f126b7d1cad1fd11"
      },
      {
        "id": "",
        "name": "66962bb324a7c5a57ba0e9663bba156576a7e6aa5c6c1401c315b3d32f8d467d"
      },
      {
        "id": "",
        "name": "8dda063860120a04bf3c7679f6a02a14aee4b5d2c3efc4dbd638dabce8a288a5"
      },
      {
        "id": "",
        "name": "e179bf035b9d9d17f8a76ecfc1ebf3b19b69f8ea05421f0d4507ded9e60c657c"
      },
      {
        "id": "",
        "name": "3da644eec41a32d72d3632b76a524d836f39f3b9854eda5d227cdf7fc4c7b543"
      },
      {
        "id": "",
        "name": "f78dad5a95bb01f14c822addc8e4ec17b3c95b7e42f27f68f678fb43a9e56d63"
      }
    ],
    "malware": [
      {
        "id": "b0a7b0af-3170-4e68-8333-4d6c9250410f",
        "name": "Telemiris",
        "slug": "telemiris"
      },
      {
        "id": "9050ce66-46e5-45d9-9e40-50e24632b7d1",
        "name": "JLORAT",
        "slug": "jlorat"
      }
    ],
    "intrusion_sets": [
      {
        "id": "c4297ea7-edfa-4f18-a472-9c13477b22d2",
        "name": "Hydra Saiga",
        "slug": "hydra-saiga"
      }
    ],
    "attack_patterns": [
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "9643a7e9-771b-4396-83a3-26fcec5200e4",
        "name": "T1021.006"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "a2ba5594-6293-4868-928c-ab4b31927a02",
        "name": "T1572"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "d570881a-1f73-41ca-ad6c-fc29256c76f9",
        "name": "T1595"
      },
      {
        "id": "e6c0ca23-78ee-4b0e-96fa-e80efab3665d",
        "name": "T1003.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      },
      {
        "id": "232fbdfa-94c6-443d-b575-373e75b4f4c2",
        "name": "T1567"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Czechia"
      },
      {
        "id": "",
        "name": "Slovakia"
      },
      {
        "id": "",
        "name": "Tajikistan"
      },
      {
        "id": "",
        "name": "Uzbekistan"
      },
      {
        "id": "",
        "name": "Egypt"
      },
      {
        "id": "",
        "name": "Azerbaijan"
      },
      {
        "id": "",
        "name": "South Africa"
      },
      {
        "id": "",
        "name": "Netherlands"
      },
      {
        "id": "",
        "name": "Mongolia"
      },
      {
        "id": "",
        "name": "Georgia"
      },
      {
        "id": "",
        "name": "South Georgia and the South Sandwich Islands"
      },
      {
        "id": "",
        "name": "Bulgaria"
      },
      {
        "id": "",
        "name": "Oman"
      },
      {
        "id": "",
        "name": "Greece"
      },
      {
        "id": "",
        "name": "Iran, Islamic Republic of"
      },
      {
        "id": "",
        "name": "Belarus"
      },
      {
        "id": "",
        "name": "Morocco"
      },
      {
        "id": "",
        "name": "Russian Federation"
      },
      {
        "id": "",
        "name": "Turkmenistan"
      },
      {
        "id": "",
        "name": "Armenia"
      },
      {
        "id": "",
        "name": "Kyrgyzstan"
      },
      {
        "id": "",
        "name": "Energy"
      },
      {
        "id": "",
        "name": "Water distribution and supply"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Legal"
      },
      {
        "id": "",
        "name": "Manufacturing"
      },
      {
        "id": "",
        "name": "Healthcare"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "Air transport"
      },
      {
        "id": "",
        "name": "message.mailboxarea.cloud"
      },
      {
        "id": "",
        "name": "naryncity.kg"
      },
      {
        "id": "",
        "name": "40minwater.uz"
      },
      {
        "id": "",
        "name": "admin.inboxsession.info"
      },
      {
        "id": "",
        "name": "auth.allcloudindex.com"
      },
      {
        "id": "",
        "name": "ex.wincorpupdates.com"
      },
      {
        "id": "",
        "name": "altaviva.ru"
      },
      {
        "id": "",
        "name": "40gov.uz"
      },
      {
        "id": "",
        "name": "adm-govuz.com"
      },
      {
        "id": "",
        "name": "docworldme.com"
      },
      {
        "id": "",
        "name": "mosreg.docworldme.com"
      },
      {
        "id": "",
        "name": "allcloudindex.com"
      },
      {
        "id": "",
        "name": "mailboxarea.cloud"
      },
      {
        "id": "",
        "name": "inboxsession.info"
      },
      {
        "id": "",
        "name": "pweobmxdlboi.com"
      },
      {
        "id": "",
        "name": "mailkeyboard.com"
      },
      {
        "id": "",
        "name": "ss.qwadx.com"
      },
      {
        "id": "",
        "name": "inbox.mailkeyboard.com"
      },
      {
        "id": "",
        "name": "france-deguisement.fr"
      },
      {
        "id": "",
        "name": "wincorpupdates.com"
      }
    ]
  },
  "external_refs": [
    "https://www.vmray.com/hydra-saiga-covert-espionage-and-infiltration-of-critical-utilities/",
    "https://otx.alienvault.com/pulse/69b9350760e55cbccb5bb598"
  ]
}