Recorded Future Examines Cyber Operations Targeting the Critical-Minerals Sector
Summary
Recorded Future examines cyber operations targeting mining and seabed-regulation organizations amid critical-mineral competition, including APT15-linked activity, campaigns in Indonesia, and BianLian’s 2024 compromise of Northern Minerals.
Key points
- Insikt Group identified infrastructure previously linked to APT15 targeting a Canadian mining company in 2021.
- In 2025, Insikt Group identified Chinese state-sponsored actors targeting an organization that monitors and regulates seabed mining.
- Insikt Group identified cyber operations targeting Indonesia between January 2021 and January 2026, but said not every intrusion could be conclusively linked to mining activity.
- Silent Lynx, also known as YoroTrooper, was reported to be targeting Russia’s mining sector in 2025.
- The report says BianLian compromised Australian rare-earth producer Northern Minerals in 2024 and published stolen data; it describes the incident as likely financially motivated.
- The report recommends limiting access to sensitive supply-chain data, reducing account-takeover risk, replacing compromised credentials quickly, and preparing for ransomware recovery.
Article Details
- Publisher
- Recorded Future (Insikt Group)
- Report Period
- Cyber operations: January 2021–January 2026; the broader analysis includes events through February 2026.
- Scope
- Cyber operations targeting mining organizations and seabed regulators, in the context of critical-mineral competition.
- Key Statistics
- Over 90% of the world's rare earth elements are processed in China, according to the article.
- Chinese companies control about 75% of Indonesia's nickel refining capacity.
- Indonesia holds approximately 55 million metric tons of nickel reserves, over 40% of global reserves.
- Chinese-linked investors held a 10.4% stake in Northern Minerals before being ordered to divest.
- Recommendations
- Restrict access to sensitive supply-chain data and key network systems, and assess third-party supply-chain risks.
- Prepare ransomware recovery plans with backup systems and data.
- Replace compromised credentials quickly and reduce the useful life of stolen credentials and keys.
- Map critical-mineral supply dependencies, identify single points of failure, and establish backup suppliers, alternate materials, and inventory buffers.
- Monitor cyber threats and geopolitical developments in emerging mining regions and hotspots.
MITRE ATT&CK
T1003 · OS Credential DumpingThe article discusses theft and reuse of credentials and keys to enable persistent access or lateral movement.T1078 · Valid AccountsThe article associates account takeover and unauthorized access to systems holding sensitive mining and supply-chain data with Valid Accounts.T1486 · Data Encrypted for ImpactThe article describes ransomware used to disrupt and extort mining organizations and publish stolen data.
Threat Actors
APT15Insikt Group identified infrastructure previously linked to APT15 targeting a Canada-based mining company in 2021. The article describes APT15 as a Chinese state-sponsored threat actor.BianLianThe ransomware group compromised Australian rare earths producer Northern Minerals in 2024 and published stolen data. The article describes it as financially motivated and says it is believed to be operated by Russia-based threat actors; state collusion could not be ruled out.Silent LynxReportedly targeted Russia's mining sector in 2025. Security researchers assessed that the group is likely Kazakhstan-based. The article also identifies YoroTrooper as an alternate name.YoroTrooperThe article identifies YoroTrooper as an alternate name for Silent Lynx, which was reported to have targeted Russia's mining sector in 2025. Researchers assessed that Silent Lynx is likely Kazakhstan-based.
Countries
Australia[Victim organizations ] examples of compromised or targeted entities – Northern Minerals (Australia), unnamed Canada-based mining company and seabed mining regulatorCanada[Victim organizations ] examples of compromised or targeted entities – Northern Minerals (Australia), unnamed Canada-based mining company and seabed mining regulatorChinaChina’s dominance of rare earth element (REE) processing and refining gives it significant geopolitical leverage, driving accelerated competition for critical minerals across the deep sea, the Arctic, Greenland,IndonesiaBetween January 2021 and January 2026, Insikt Group identified multiple sophisticated cyber operations targeting Indonesia.KazakhstanSecurity researchers assessed that Silent Lynx is likely Kazakhstan-based, due to its language fluency, use of local currency, and regional targeting.RussiaChina and Russia have announced plans to expand their presence in Antarctica.
Industries
GovernmentThe US government has since accelerated international critical minerals deals and begun investing in US mining operations to minimize its reliance on China, where over 90% of the world’s REEs are processed.Mining and metalsFigure 8: Data from Recorded Futureʼs Ransomware Dashboard showing the top five ransomware groups targeting the mining and metals sector in 2025 Source: Recorded Future)