TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
Cisco Talos and Recorded Future’s Insikt Group report sustained espionage by TAG-193, tracked as UAT-6275 and also known as Silent Lynx, against government organizations in Central Asia and the CIS. Campaigns from early 2025 through May 2026 involved entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan, with interests in diplomacy, economics, water, and forestry. Operators phished from compromised government accounts and hosted payloads on GitHub, using LAPLAS, FoalShell, and PowerShell reverse shells. In April 2026 a chain likely aimed at Armenia’s Ministry of Foreign Affairs exploited WinRAR CVE-2025-8088 to drop malware into the Windows Startup folder. A FortiWeb exploit was recovered, but exploitation was not confirmed.