Do Son 
Regional targeting | Image: Cisco Talos
TL;DR
Security researchers uncovered an active espionage campaign led by the UAT-6275 threat actor against government agencies across the Commonwealth of Independent States (CIS). Between June 2025 and August 2026, the group deployed four distinct infection chains, including a WinRAR vulnerability exploit. Moreover, operational security mistakes exposed the group’s staging servers and GitHub repositories to investigators.
What Happened in the Campaigns
According to a joint report from Cisco Talos and Recorded Future Insikt Group, UAT-6275 targeted government networks from June 2025 through August 2026. Specifically, researchers discovered three open staging directories and a public GitHub repository containing the group’s scripts. “These operational security lapses gave us direct visibility into the group’s recent activity,” Cisco Talos reported.
Furthermore, investigators categorized the group’s delivery methods into four distinct infection chains. First, in June 2025, the hackers used macro-enabled Word documents to drop second-stage binaries. Next, in July 2025, they switched to standalone executables built with PS2EXE. By October 2025, the group used malicious shortcuts to run PowerShell scripts hosted on GitHub.
Exploiting WinRAR and Custom Shells
In April 2026, UAT-6275 adopted its first software vulnerability exploit. Specifically, the attackers crafted a malicious RAR archive that exploited CVE-2025-8088 in WinRAR. Consequently, this archive planted a reverse shell called PickleShell directly into the Windows Startup folder. Across these campaigns, the group relied on custom reverse shells, including Chvost, Laplas, and PickleShell, to maintain remote access. Additionally, researchers found Linux tools and a proof-of-concept exploit for FortiWeb CVE-2025-25257 on the exposed servers.
Who Is Behind the Activity
Cisco Talos tracks this group as UAT-6275, while Recorded Future tracks the same cluster as TAG-193. The activity also overlaps with Silent Lynx and sits within a broader cluster linked to YoroTrooper. “Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on infrastructure access, language artifacts, sample submissions, working hours analysis, and regional targeting interests,” the researchers stated. Notably, 95% of the group’s 77 GitHub commits occurred between 09:00 and 18:00 in the UTC+5 Astana time zone.
Impact and Regional Scale
Since January 2025, researchers have tracked at least eight campaigns affecting nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The UAT-6275 threat actor primarily targets diplomatic, economic, agricultural, and environmental ministries. For instance, attackers targeted a Tajik agency right after treaty talks with Kazakhstan in March 2026.
In addition, decoy documents revealed a strong focus on regional energy and water security. One August 2025 lure impersonated Turkmenistan’s state oil company, Turkmennebit, proposing cooperation with Russia’s Orsk Oil Refinery. That refinery supplies fuel to Kazakhstan and later halted operations following an August 2026 drone strike.
How Organizations Can Stay Protected
Because UAT-6275 continues to refine its delivery methods, government and critical infrastructure defenders must stay alert. First, administrators should patch archive utilities like WinRAR immediately to block CVE-2025-8088 exploitation. Furthermore, security teams should monitor for unusual PowerShell executions and payload downloads originating from GitHub. Finally, defenders must audit scheduled tasks and Windows Startup folders to detect persistent reverse shells like PickleShell.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
