nur.kz Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting the domain nur.kz, with 16,114 historical data breaches and 125 active infostealer logs observed over the period from July 2025 to June 2026. The data breaches represent 99.2% of the total events, while infostealer activity accounts for 0.8%. A notable surge in employee-related events occurred in September 2025, with 8,361 instances, followed by smaller peaks in January, February, and June 2026. Client-related events also saw increases in August 2025 and March 2026. Malware families associated with these events include Redline (21.6%), LummaC2 (8.8%), Vidar (4.8%), and Rhadamanthys (4%). The high volume of historical data breaches and active infostealer logs, coupled with the targeting of services like nur.kz and rabota.nur.kz/login, suggests a high-priority risk. The prevalence of infostealer malware indicates a potential for credential harvesting and further compromise. Remediation efforts should focus on investigating the root cause of the historical data breaches, enhancing endpoint security to detect and prevent infostealer infections, and reviewing access controls for the targeted services.