Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Reported exploitedWinRARUAT-6275Windows PowerShellOur summary
Cisco Talos, working with Recorded Future's Insikt Group, has exposed a Kazakhstan-linked threat cluster dubbed UAT-6275 (also tracked as TAG-193 and overlapping with Silent Lynx) that has been spying on government bodies across Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus since June 2025, with particular interest in diplomacy, water resources and energy. Between June 2025 and August 2026 the actor used four separate delivery chains — malicious macro documents, PS2EXE-built downloaders, GitHub-hosted PowerShell scripts, and a weaponized WinRAR archive abusing CVE-2025-8088 — to drop custom reverse shells such as PickleShell, Chvost and Laplas for interactive remote access. Researchers also found a public proof-of-concept for the FortiWeb flaw CVE-2025-25257 and Linux-capable tools staged on exposed infrastructure, hinting at plans to broaden targeting beyond Windows. Talos recommends monitoring suspicious PowerShell and startup-folder activity and promptly patching archive software to blunt this exploit-driven delivery method.
Below is the opening; the full story is at Cisco Talos.
From Cisco Talos
Wednesday, October 14, 2026 10:00
This research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future’s Insikt Group. Details of the joint research and presentation are available here.
- Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war.
- In activity observed from June 2025 through August 2026, Talos identified four infection-chain types that use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088. The recovered payloads include several custom reverse shells that provide interactive remote access.
- Three publicly accessible staging directories and GitHub repository history exposed payload builds, tool inventories, and changes to command-and-control (C2) infrastructure. These operational security lapses gave us direct visibility into the group's recent activity.
- The files recovered from the exposed infrastructure suggest preparation for post-compromise operations and potential activity against Linux hosts and internet-facing appliances.
- Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on infrastructure access, language artifacts, sample submissions, working hours analysis, and regional targeting interests.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.