Suspected Kazakhstan-linked hackers target governments across former Soviet states
Suspected Kazakhstan-linked UAT-6275 ran at least eight espionage campaigns against former Soviet governments since 2025.
Cisco Talos and Recorded Future's Insikt Group say a suspected Kazakhstan-linked espionage group, tracked as UAT-6275 and TAG-193, has run at least eight campaigns since January 2025 against government agencies in nine countries, including Russia, Belarus, Armenia, Uzbekistan, and Tajikistan. The operators phish with malicious attachments, sometimes from already compromised government accounts, and store scripts on GitHub. In April 2026 they exploited WinRAR CVE-2025-8088, likely against Armenia's foreign ministry, to plant malware in a Windows startup folder. Researchers assess Kazakhstan ties with medium confidence and note overlap with earlier YoroTrooper activity.