Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations By Amaury G., Maxime A., Erwan Chevalier, Felix Aimé and Sekoia TDR Published: 2025-01-13 · Archived: 2026-04-05 16:27:55 UTC This report was originally published for our customers on 12 December 2024. Table of contents Introduction I. UAC-0063 background II. Initial findings III. HATVIBE and CHERRYSPY infection chain Double-Tap infection chain leading to HATVIBE execution Focus on HATVIBE A potential overlap with APT28-related Zebrocy campaigns IV. From Kazakhstan to Central Asia: a focus on a broader strategic espionage Kazakhstan geopolitical context Kazakhstan targeting for broader intelligence gathering V. Detection opportunities Registry change Scheduled task Conclusion Appendix C2 Weaponized documents Deobfuscated HATVIBE VBA code YARAs Introduction On Wednesday, 27 November 2024, Russian President Putin was on a 2-day state visit in Kazakhstan to discuss with local representatives the implementation of energy projects and to counter Chinese and Western influence. Putin said he was visiting his “true ally”, yet Sekoia investigated an ongoing cyber espionage campaign using legitimate Office documents assessed to originate from the Ministry of Foreign Affairs of the Republic of Kazakhstan, that were further weaponized and likely used to collect strategic intelligence in Central Asia, including Kazakhstan and its diplomatic and economic relations with Asian and Western countries. We assess it is https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain Page 1 of 19 possible that this campaign was conducted by a Russia-nexus intrusion set, UAC-0063, sharing overlaps with APT28. I. UAC-0063 background UAC-0063 is an intrusion set active since at least 2021 that was first exposed by CERT-UA in April 2023 for conducting a cyber espionage campaign targeting several countries such as Ukraine, Israel and India, including multiple central Asian countries (Kazakhstan, Kyrgyzstan and Tajikistan). CERT-UA analysts identified spearphishing lure Word documents with malicious macros sent by a compromised official mailbox of the Embassy of Tajikistan in Ukraine.  UAC-0063 targeting suggests a focus on intelligence collection in sectors such as government, including diplomacy, NGOs, academia, energy, and defence, with a geographic focus on Ukraine, Central Asia, and Eastern Europe.  Later, in July 2024, CERT-UA published another report exposing UAC-0063 activities targeting Ukrainian scientific research institutions with new malware (dubbed HATVIBE and CHERRYSPY). The report associates the intrusion set UAC-0063 with APT28 with medium confidence.  As a reminder, APT28 is a well-studied intrusion set active since at least 2004, attributed by multiple governments and cybersecurity experts to Russia’s General Staff Main Intelligence Directorate (GRU) Military Unit 26165. This intrusion set is especially known for its hybrid operations on the sidelines of armed conflicts (Ukraine 2015, 2017, 2022), election manipulation (2016 US and 2017 French Presidential Election), and diplomatic crises related to Russia (TV5 Monde 2015). Our colleagues from Recorded Future are tracking UAC-0063 under the alias TAG-110, assessing that its activities overlap with APT28’s strategic interests, yet without confirming the CERT-UA’s medium confidence association with APT28 based on technical elements. II. Initial findings In late July 2024, our attention was drawn to an article published by CERT-UA detailing the activities of the UAC-0063 intrusion set, leveraging HATVIBE and CHERRYSPY malware to conduct cyber espionage operations against government institutions. We conducted further research to identify a pattern for future Command and Control (C2) servers and to further track it through our Sekoia C2 Trackers project. We also created a set of YARA rules to detect the infection chain and the deployed malware. On 16 October 2024, one of our YARA rules that detects malicious macros caught a malicious file uploaded to VirusTotal. The Office document titled Rev5_Joint Declaration C5+GER_clean version.doc seemed to be a draft version of a diplomatic join statement containing a malicious macro that prompts the user for permission for execution and lead to the compromise of the host. Within a function in the macro, we observed the removal of the document’s protection using a highly unique password. By pivoting on this password, we were able to identify 10 additional Word documents that had not yet been publicly disclosed. https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain Page 2 of 19 Our investigation led us to find 18 DOCX files with embedded macros, including seven blank documents that are part of the same infection chain. Almost all documents likely originally belong to the Ministry of Foreign Affairs of the Republic of Kazakhstan, either as correspondence letters, draft documents, or internal administrative notes. They are dated from 2021 to October 2024 (based on both internal dates and metadata). The most recent documents are two diplomatic letters, one from the Embassy of Kazakhstan in Afghanistan, the second from the Embassy of Kazakhstan in Belgium, both intended for the central Ministry of Foreign Affairs regarding diplomatic cooperation and economic issues. The both are dated early September 2024.  Another identified weaponized document is an ongoing reviewed draft for a joint statement between Germany, Kazakhstan and Central Asia leaders (Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan) following a diplomatic meeting in Astana on 16 September 2024. We found the final version of the statement published on the official German government website, providing further evidence that the bait documents were not forged. Other documents are administrative reports or briefings regarding official meetings between Kazakhstan officials and foreign stakeholders, such as the state visit from Kazakhstan president Tokaiev in Mongolia in October 2024 or his meeting with executives of US companies in New York during the 78th session of the UN General Assembly in September 2024.  The only document which does not seem to have been issued by the Ministry of Foreign Affairs of the Republic of Kazakhstan is a correspondence letter from the Ministry of Defense of the Kyrgyz Republic intended for military cooperation among Central Asian countries. Its content is related to intelligence sharing about “the previously announced special operation of the People’s Republic of China against Taiwan”. Sekoia assess it likely refers to the 2022 Chinese military exercises around Taiwan, a series of military exercises by the People’s Liberation Army that encircled Taiwan in August 2022. https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain Page 3 of 19 Last but not least, what appears to be the oldest document is an internal Kazakhstan Ministry of Foreign Affairs 2021 administrative note alerting Kazakhstan officials about cyber espionage attempts and general information security, a document weaponized for this purpose. https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain Page 4 of 19 III. HATVIBE and CHERRYSPY infection chain The infection chain related to this campaign includes the malware HATVIBE and CHERRYSPY. It has previously been partially documented in open source. In May 2023, Bitdefender highlighted HATVIBE and CHERRYSPY malware that have been used in a cyber espionage campaign targeting Asia, since at least late 2022. A few days later, CERT-UA also reported on these malware, linking them to the probable compromise of the official email account of the Tajikistan Embassy in Ukraine, which had been used to target Kazakhstan, Kyrgyzstan, Mongolia, Israel, and India. https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain Page 5 of 19 Over a year later, in July 2024, CERT-UA disclosed that Ukraine’s scientific research institution has been compromised again via an employee’s email account, proving that this campaign was still ongoing at that time. Last, in November 2024, Recorded Future shed light on the scale of this campaign, reporting 62 confirmed unique victims across Central Asia, East Asia, and Europe since July 2024. Although the infection chain was already partially documented, the ten documents identified by Sekoia exhibit a previously unknown malicious code, while retaining a similar execution structure. For this analysis, we will focus a Word document titled Rev5_Joint Declaration C5+GER_clean version.doc (MD5: 35fee95e38e47d80b470ee1069dd5c9c), which is a commented draft of a joint declaration between the Heads of Central Asia countries and the Chancellor of Germany.  This document was weaponized on 13 September 2024 with a malicious macro aimed at creating another malicious document. This second document is automatically opened in an hidden Word instance by the initial macro, to drop and execute a malicious HTA (HTML Application) file embedding a VBS backdoor nicknamed “HATVIBE” by the CERT-UA. As this infection chain is pretty unique, we named it Double-Tap and decided to take a look at it. Double-Tap infection chain leading to HATVIBE execution When the Rev5_Joint Declaration C5+GER_clean version.doc document is opened, the user is prompted to execute a malicious macro. When executed, this macro does several things such as: It downgrades the security settings which ask the user to execute macros by altering the HKCU\Software\Microsoft\Office\[VERSION]\Word\Security\AccessVBOM registry key. This will lead to the execution of the malicious macro of the second document without user confirmation. It unprotects the document with a hardcoded password to delete shapes implemented by the attacker over it and saves it. The use of shapes is a quite common social engineering technique as it pushes the target to activate the macro in order to see the document’s content.  It creates a second blank document under C:\Users\[USER]\AppData\Local\Temp\. This second document is populated from variables present in the settings.xml of the first document and weaponised by adding a malicious macro to it. This malicious macro is also extracted from the settings.xml of the first document. Then, it launches in a hidden Microsoft Word instance this second malicious document, which will execute its macro completely silently as the AccessVBOM registry key has been previously altered. The macro embedded in the second document is much more straightforward. It gets malicious VBA code to execute from variables in its settings.xml file. And then executes two methods from this code: The first method extracts the contents of an HTA file embedding HATVIBE variables in its settings.xml and saves it under C:\Users\[USER]\AppData\Local\Settings\locale (without any extension). The second method creates a scheduled task named “Settings\ServiceDispatch” by using RegisterTaskDefinition. This task aims to execute the HTA containing HATVIBE’s code every four minutes by launching mshta.exe. https://blog.sekoia.io/double-tap-campaign-russia-nexus-apt-possibly-related-to-apt28-conducts-cyber-espionage-on-central-asia-and-kazakhstan-diplomatic-relations/#h-iii-hatvibe-and-cherryspy-infection-chain Page 6 of 19 The full chain can be summarised in the scheme below: What makes this Double-Tap infection chain quite unique is that it employs many tricks to bypass security solutions such as storing the real malicious macro code in the settings.xml file and creating a scheduled task without spawning schtasks.exe for the second document or using, for the first document, an anti-emulation trick aimed to see if the execution time has not been altered, otherwise the macro is stopped. Focus on HATVIBE The HTA launched by the scheduled task contains the VBS backdoor named “HATVIBE” by the CERT-UA. The aim of this backdoor is to receive VBS modules for execution from a remote C2 server. Once received, HATVIBE uses a simple XOR algorithm to decrypt each module, contact it between two