UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.
Cisco Talos and Recorded Future’s Insikt Group say UAT-6275, also tracked as TAG-193, targeted government organizations across the CIS from June 2025 through August 2026. Since April 2026 the group has abused WinRAR path-traversal flaw CVE-2025-8088 so crafted RAR archives using NTFS alternate data streams drop the PickleShell reverse shell into the user’s Startup folder. Earlier chains used macro-enabled Word documents, PS2EXE downloaders, scheduled tasks, and malicious shortcuts that retrieved payloads from GitHub. Custom shells also include Chvost and Laplas. Talos assesses a Kazakhstan connection with medium confidence and did not confirm in-the-wild FortiWeb exploitation by this actor.