Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Kazakhstan-linked UAT-6275 targeted CIS governments using phishing and a WinRAR exploit.
Cisco Talos and Recorded Future's Insikt Group report that UAT-6275, also tracked as TAG-193, targeted government organizations across the Commonwealth of Independent States from June 2025 through August 2026, with additional interest in water and energy. Four infection chains used macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a WinRAR archive exploiting CVE-2025-8088, delivering custom reverse shells. Exposed staging directories and a GitHub repository revealed payload builds and command-and-control changes. Talos assesses a Kazakhstan nexus with medium confidence and links the cluster to Silent Lynx and the broader YoroTrooper activity set while tracking them separately.