Kiran 
Cisco Talos and Recorded Future’s Insikt Group report that UAT-6275 has spent more than a year spying on government bodies across the Commonwealth of Independent States (CIS).
The group’s own sloppy infrastructure exposed its tools, malware builds, and plans. Recorded Future tracks the group as TAG-193, and it overlaps with Silent Lynx.
Talos observed the activity from June 2025 through August 2026. It centered on Central Asia and the wider CIS, with victims and lure themes spanning nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.
Kazakhstan-Linked UAT-6275 Hacks CIS Government Networks
Targets included ministries handling diplomacy, economic development, agriculture and environmental management. Recovered artifacts also point to interest in water resources and energy. Talos says this pattern fits intelligence collection and may reflect the regional fallout of the Russia–Ukraine war.
Timing offers clues about intent. Network flow analysis showed activity involving a Tajik government entity shortly after treaty talks with Kazakhstan in March 2026.
It also showed activity involving a Belarusian entity ahead of an April bilateral meeting. Decoy documents included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs.
Another decoy impersonated Turkmenneft and proposed cooperation with Russia’s Orsk Oil Refinery. That refinery supplies Kazakhstan and was later shut down by a Ukrainian drone strike in August 2026.
Talos sorted the group’s malware delivery into four infection chains. Chain A, seen in June 2025, used macro-enabled Word documents to fetch a second-stage binary.
Chain B arrived in July 2025 with downloaders built using PS2EXE, which packages PowerShell scripts as Windows executables. These pulled reverse shells and created scheduled tasks for persistence.
Chain C appeared in October 2025. A malicious shortcut launches PowerShell to pull a script from GitHub, and later samples dropped PickleShell into the Windows Startup folder. In April 2026, Chain D introduced a crafted RAR archive exploiting CVE-2025-8088 in WinRAR.
It plants PickleShell in the Startup folder so it runs at the next sign-in. It was the first vulnerability exploit Talos saw in the group’s delivery.
The operators rely on small reverse shells, including Chvost, Laplas, and PickleShell, that provide interactive remote access.
Three publicly accessible staging directories and a previously unreported GitHub repository exposed payload builds, tool inventories and command-and-control changes. A GitHub commit history let researchers follow the malware’s development.
The exposed files also hint at what comes next. Researchers recovered Linux-compatible tooling and a public proof-of-concept exploit for FortiWeb CVE-2025-25257. That suggests preparation for post-compromise work and possible attacks on Linux hosts and internet-facing appliances.
Talos assesses with medium confidence that the group has a Kazakhstan nexus. The evidence includes Russian-language artifacts and apparent malware-testing submissions from Kazakhstan shortly after compilation.
It also includes infrastructure access and operator activity consistent with UTC+5 working hours. An analysis of 77 GitHub commits supported that timing. Medium confidence means this is a reasoned judgment, not proof.
Talos also links UAT-6275 to the YoroTrooper cluster it first reported in 2023. It tracks the two separately because it has seen no direct indicator or toolset overlap. Other vendors have described overlapping clusters named Tomiris, ShadowSilk, Cavalry Werewolf, and Hydra Saiga.
Mitigation
Organizations in government, energy, and environmental sectors should watch for unexpected PowerShell activity and payload downloads from public services such as GitHub.
They should also monitor scheduled tasks and changes to the Startup folder. Keeping archive utilities like WinRAR patched reduces exposure to the Chain D exploit.
Full indicators of compromise are in the joint Virus Bulletin 2026 white paper, “Break the silence: tracking Silent Lynx through exposed infrastructure.”
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
