UAT-6275 (Threat actor): news timeline & CVEs

Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government

Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.

Cisco Talos and Recorded Future describe Silent Lynx (UAT-6275, TAG-193), a Kazakhstan-nexus espionage group active since at least 2024 against Central Asian governments, diplomatic missions, and civil society. Recent activity targeted Russia's Orsk Oil Refinery and the government of Nizhny Novgorod, using spear-phishing from compromised Tajik and Kyrgyz government accounts and staging on GitHub, Telegram, and hijacked servers. The lightweight toolkit includes PowerShell reverse shells, custom shells in C++, C#, and Go (including PickleShell and Chvost), and commodity tunnels. Researchers cite Astana working hours, Kazakhstan ProtonVPN administration, and rapid VirusTotal uploads from Kazakhstan, while saying motive is unproven.

Security AffairsOct 15, 18:33 UTC · 1d agoThreat actor in the wild 6 sources3· 1 read

The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.

Cisco Talos’s Threat Source newsletter argues that record CVE volume is not a zero-day apocalypse. By late September 2026, published CVEs had passed 70,000 and were up 105% year over year, while CISA KEV grew 37%; CVEs from 2025 or earlier still made up 33% of KEV, and networking-gear CVEs rose to 27%. The same edition flags UAT-6275 espionage against CIS government and critical infrastructure using macro documents, GitHub scripts, and a WinRAR flaw, plus headlines on CVE-2026-104935 in Ivanti Connect Secure and an actively attacked maximum-severity SonicWall SMA SSRF.

Cisco Talosupdated Oct 15, 18:29 UTC · 1d agofirst Oct 15, 18:00 UTC · 1d agoResearch in the wild 16 sources CVE-2014-125110 CVE-2015-1000013 CVE-2026-104935

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.

Cisco Talos and Recorded Future attribute attacks from June 2025 through August 2026 to Silent Lynx, tracked as UAT-6275 and TAG-193, against government organizations in Central Asia and the wider CIS. Four infection chains used macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives exploiting CVE-2025-8088. The campaigns deployed custom reverse shells including FoalShell, Chvost, Laplas, and PickleShell, with scheduled tasks or the Startup folder for persistence. Public staging directories also held a proof-of-concept for FortiWeb SQL injection CVE-2025-25257.

The Hacker Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 16:00 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088 CVE-2025-25257

Suspected Kazakhstan-linked hackers target governments across former Soviet states

Suspected Kazakhstan-linked UAT-6275 ran at least eight espionage campaigns against former Soviet governments since 2025.

Cisco Talos and Recorded Future's Insikt Group say a suspected Kazakhstan-linked espionage group, tracked as UAT-6275 and TAG-193, has run at least eight campaigns since January 2025 against government agencies in nine countries, including Russia, Belarus, Armenia, Uzbekistan, and Tajikistan. The operators phish with malicious attachments, sometimes from already compromised government accounts, and store scripts on GitHub. In April 2026 they exploited WinRAR CVE-2025-8088, likely against Armenia's foreign ministry, to plant malware in a Windows startup folder. Researchers assess Kazakhstan ties with medium confidence and note overlap with earlier YoroTrooper activity.

The Recordupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 13:55 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088

UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.

Cisco Talos and Recorded Future’s Insikt Group say UAT-6275, also tracked as TAG-193, targeted government organizations across the CIS from June 2025 through August 2026. Since April 2026 the group has abused WinRAR path-traversal flaw CVE-2025-8088 so crafted RAR archives using NTFS alternate data streams drop the PickleShell reverse shell into the user’s Startup folder. Earlier chains used macro-enabled Word documents, PS2EXE downloaders, scheduled tasks, and malicious shortcuts that retrieved payloads from GitHub. Custom shells also include Chvost and Laplas. Talos assesses a Kazakhstan connection with medium confidence and did not confirm in-the-wild FortiWeb exploitation by this actor.

Cyber Security Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 09:08 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Kazakhstan-linked UAT-6275 targeted CIS governments using phishing and a WinRAR exploit.

Cisco Talos and Recorded Future's Insikt Group report that UAT-6275, also tracked as TAG-193, targeted government organizations across the Commonwealth of Independent States from June 2025 through August 2026, with additional interest in water and energy. Four infection chains used macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a WinRAR archive exploiting CVE-2025-8088, delivering custom reverse shells. Exposed staging directories and a GitHub repository revealed payload builds and command-and-control changes. Talos assesses a Kazakhstan nexus with medium confidence and links the cluster to Silent Lynx and the broader YoroTrooper activity set while tracking them separately.

Cisco Talosupdated Oct 15, 18:33 UTC · 1d agofirst Oct 14, 14:00 UTC · 2d agoThreat actor in the wild 6 sources CVE-2025-8088

TAG-193’s Regional Espionage Operations

TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.

Cisco Talos and Recorded Future’s Insikt Group report sustained espionage by TAG-193, tracked as UAT-6275 and also known as Silent Lynx, against government organizations in Central Asia and the CIS. Campaigns from early 2025 through May 2026 involved entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan, with interests in diplomacy, economics, water, and forestry. Operators phished from compromised government accounts and hosted payloads on GitHub, using LAPLAS, FoalShell, and PowerShell reverse shells. In April 2026 a chain likely aimed at Armenia’s Ministry of Foreign Affairs exploited WinRAR CVE-2025-8088 to drop malware into the Windows Startup folder. A FortiWeb exploit was recovered, but exploitation was not confirmed.

Recorded Futureupdated Oct 15, 18:33 UTC · 1d agofirst Oct 14, 00:00 UTC · 3d agoThreat actor in the wild 6 sources CVE-2025-8088

UAT-6275

Timeline7 articles

Related CVEsby mentions

Appears with