TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
Cisco Talos and Recorded Future’s Insikt Group report sustained espionage by TAG-193, tracked as UAT-6275 and also known as Silent Lynx, against government organizations in Central Asia and the CIS. Campaigns from early 2025 through May 2026 involved entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan, with interests in diplomacy, economics, water, and forestry. Operators phished from compromised government accounts and hosted payloads on GitHub, using LAPLAS, FoalShell, and PowerShell reverse shells. In April 2026 a chain likely aimed at Armenia’s Ministry of Foreign Affairs exploited WinRAR CVE-2025-8088 to drop malware into the Windows Startup folder. A FortiWeb exploit was recovered, but exploitation was not confirmed.
- TAG-193, also UAT-6275 and Silent Lynx, targeted regional governments.
- Activity ran from early 2025 through May 2026 across several CIS states.
- An April 2026 chain abused WinRAR CVE-2025-8088 for Startup persistence.
- Tooling includes LAPLAS, FoalShell, and PowerShell reverse shells via GitHub.
Vulnerabilities mentionedAll →
- CVE-2025-80888.494%WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Executionpublished · RARLAB WinRAR KEV ransomware
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-8088 |
Full article1,005 words · extracted from recordedfuture.com · click to collapse
Joint research by Cisco Talos and Recorded Future’s Insikt Group examined sustained cyber-espionage activity by TAG-193 targeting government organizations across Central Asia and the wider Commonwealth of Independent States (CIS). Tracked by Cisco Talos as UAT-6275 and also known as Silent Lynx, TAG-193 combines diplomatic and economic targeting with an interest in environmental policy, water resources, and forestry. Exposed infrastructure provided new visibility into its malware, operational practices, and evolving delivery techniques. The findings point to possible links to Kazakhstan, but questions remain about the group’s origins. This post highlights how TAG-193’s operations reflect the intelligence value of regional diplomacy and resource management, and how its expanding toolkit supports that mission.
Government Targeting across the Region
TAG-193’s targeting extends across government institutions responsible for diplomacy, economic development, agriculture, and environmental management. These organizations hold information that can inform negotiations, economic planning, and regional security decisions. Across Central Asia, shared river systems and interconnected energy and transport infrastructure give such information particular strategic value.
Figure 1: Timeline of TAG-193 campaigns
Our research examined TAG-193 campaigns from early 2025 through May 2026, identifying activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan. Lure documents and impersonated services indicated additional targeting interests across the region. Together, these findings suggest a sustained intelligence-collection mission encompassing diplomatic priorities and the management of natural resources.
Figure 2: Overview of TAG-193 victimology
Diplomacy, Water Security, and Resource Management
Several TAG-193 intrusions identified through Recorded Future® Network Intelligence occurred around diplomatic developments involving Kazakhstan. Following Kazakhstan’s parliamentary consideration of a treaty on allied relations with Tajikistan, we noted communications between a Tajik government entity responsible for economic development and TAG-193 infrastructure. Additionally, activity involving a Belarusian agriculture-related government entity preceded a senior bilateral meeting in Astana. While these temporal associations do not establish that the TAG-193-related activity was connected to the described developments or reveal what information the operators sought, they do provide context indicating TAG-193’s targeting interests.
TAG-193’s recurring interest in environmental and resource-management institutions is also noteworthy. Observed activity involved an Armenian government entity responsible for environmental matters and infrastructure associated with Uzbekistan’s Smart Forestry initiative, which supports digital forestry management, environmental monitoring, and ecological restoration. Additional targeting involved Nizhny Novgorod, Russia, at the confluence of the Volga and Oka rivers within the Caspian Sea basin. Although its geographic location alone does not establish a water-related collection objective, earlier reporting linked TAG-193 to the targeting of water-resource organizations across Central Asia, providing further context for this apparent interest.
In Kazakhstan, water security is closely tied to economic stability and national security. Dependence on cross-border water supplies leaves the country exposed to upstream decisions about water use, storage, and diversion. Climate change, glacier loss, and inefficient irrigation place additional pressure on water availability, with implications for agriculture, industry, and domestic supplies. The Aral Sea disaster illustrates the lasting economic, environmental, and public-health consequences of water mismanagement, helping explain why water security remains a strategic priority.
Trusted Accounts and Services Support Access
TAG-193 frequently sends spearphishing emails from compromised government accounts, using official-looking documents to make its communications credible. Identified lures included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery. While not independently establishing successful compromises of the organizations these documents reference, they do indicate targeting interests.
Figure 3: Example lure document used by TAG-193
The group also uses public services such as GitHub to host malicious scripts and payloads. Together, trusted sender accounts and familiar hosting services help malicious content blend into routine government workflows.
Exposed directories on TAG-193 infrastructure revealed additional malware and a previously undocumented GitHub staging account. These operational security lapses enabled researchers to connect campaigns and trace changes in the group’s tooling.
An Evolving Toolkit
TAG-193 relies heavily on lightweight, interactive reverse shells that allow operators to issue commands on compromised systems. Its tooling includes LAPLAS, multiple FoalShell variants, and PowerShell-based reverse shells. Analysis of recovered samples identified four infection-chain types, including a newly observed chain using exploit-assisted delivery.
Observed in April 2026 and likely used against Armenia’s Ministry of Foreign Affairs, this chain exploited the WinRAR vulnerability CVE-2025-8088 to place malware in the Windows Startup folder, enabling execution when the user next signed in. The activity demonstrated the group’s adoption of vulnerability exploitation alongside its established social engineering techniques.
Linux-compatible tooling and a publicly available FortiWeb exploit recovered from TAG-193 infrastructure suggest that TAG-193 is interested in expanding its operational capabilities. However, the research did not confirm that the group exploited the FortiWeb vulnerability in the wild.
Clues to TAG-193’s Origins
Russian-language artifacts, apparent malware-testing submissions from Kazakhstan, and activity patterns consistent with Kazakhstan’s working hours collectively support an assessment that TAG-193 likely operates from Kazakhstan. These indicators inform the geographic assessment but do not establish the group’s organizational affiliation or state sponsorship, both of which remain unresolved.
Figure 4: TAG-193 activity analysis
Looking Ahead
TAG-193 is likely to continue targeting government, diplomatic, and resource-management organizations across the region. Its sustained operations and adoption of additional delivery techniques suggest continued investment in gaining access to institutions holding information of strategic interest.
For defenders, the findings underscore the importance of protecting environmental agencies, forestry platforms, and economic ministries, as well as foreign affairs and national security institutions. Monitoring for compromised email accounts, malicious content hosted on trusted public services, and unexpected remote-access activity can help identify intrusions that begin with seemingly routine government communications.
For further details on this research and our accompanying presentation, see “Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure” on Virus Bulletin’s website, as well as Cisco Talos’s related blog post, “Break The Silence: Kazakhstan-Nexus UAT-6275 Targets Government And Energy Organizations Across The CIS”.
About Insikt Group®
Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience. Its mission is to produce intelligence that reduces risk for customers, enables tangible outcomes, and prevents business disruption.