UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

UAT-6275 hackers have used a known WinRAR flaw to plant malware on Windows systems while targeting government organizations across the Commonwealth of Independent States (CIS).

The activity shows how an unpatched archive tool can turn a routine attachment into lasting remote access, with the malicious program starting when the victim next signs in.

The campaign involves CVE-2025-8088, a path traversal flaw that lets crafted archives write files outside the folder chosen for extraction.

Researchers observed the group adding this method in April 2026, alongside older attacks using Word macros, executable downloaders, and malicious shortcuts. The wider activity reviewed ran from June 2025 through August 2026.

Cisco Talos researchers, working with Recorded Future’s Insikt Group, identified the malware and linked the activity to UAT-6275, tracked by Recorded Future as TAG-193.

Their October 14 research report describes custom reverse shells named PickleShell, Chvost, and Laplas. These tools let attackers send commands to infected computers and receive the results through remote connections.

UAT-6275 Hackers Exploit WinRAR Flaw

The WinRAR attack, classified as Chain D, used a RAR archive containing two visible PDF decoys. Hidden inside were payload records that abused NTFS alternate data streams, a Windows file feature.

The WinRAR path traversal flaw allowed those records to place PickleShell in the current user’s Startup folder instead of the expected extraction location.

The archive included ten hidden stream names pointing to the same payload, with different numbers of parent-folder steps. This approach helped account for different extraction locations.

A successful write placed the executable in Startup without requiring administrator rights. The malware then ran at the next sign-in, giving the attacker a foothold without another prompt.

PickleShell is a C#/.NET reverse shell that poses as a Windows service component. The analyzed payload starts a hidden command shell and passes command input and output to its control server. Later builds used encrypted connections.

Researchers also found a stable identifier across nine samples, offering defenders another way to hunt for related files despite name changes.

Earlier activity began with macro-enabled Word documents in June 2025. When a victim enabled macros, the document downloaded and ran another program.

From July, PS2EXE downloaders packaged PowerShell scripts as Windows executables, fetched reverse-shell payloads, and created scheduled tasks to keep running. These stages show that the WinRAR exploit expanded an existing toolkit rather than replacing it.

Four Delivery Paths Support Access

From October 2025, malicious shortcuts launched PowerShell to retrieve scripts from GitHub. Later versions also downloaded PickleShell into Startup.

Earlier Silent Lynx phishing campaigns used similar government-themed attachments and shortcuts. Talos reported overlap with Silent Lynx but continues to track UAT-6275 separately from YoroTrooper because direct indicator or toolset overlap between those two groups was not observed.

Three exposed staging directories and a previously unreported GitHub repository gave investigators access to payloads, tool lists, and infrastructure changes.

The repository’s history helped trace malware updates and control-server changes. Similar GitHub malware delivery methods appear in unrelated campaigns, underlining why defenders should examine script behavior rather than assume that downloads from a trusted platform are safe.

Observed victims and lure themes covered Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

The targeted work included diplomacy, economic planning, agriculture, environmental management, and energy. Decoys included an Armenian diplomatic letter and a proposal involving Turkmenistan’s Turkmennebit and Russia’s Orsk Oil Refinery, suggesting interest in regional talks and resource supplies.

Talos assessed a Kazakhstan connection with medium confidence, citing language clues, testing submissions, infrastructure access, and working hours consistent with UTC+5.

That assessment does not establish government sponsorship. Investigators also recovered Linux-compatible tools and a public FortiWeb exploit, but the joint paper did not confirm that this actor had exploited FortiWeb systems in the wild.

Organizations should update affected WinRAR installations to a supported release containing the fix introduced in version 7.13. Other WinRAR exploitation campaigns show why archive software deserves regular patch checks.

Security teams should review unexpected Startup-folder files, new scheduled tasks, hidden PowerShell sessions, and scripts downloaded from public repositories, especially when these events follow archive extraction or suspicious email attachments.

The finding also calls for careful incident review: removing the original RAR attachment does not remove a payload already written to Startup. Defenders should connect file creation, process execution, and outbound traffic when checking suspected infections.

Talos published ClamAV signatures and Snort rules for coverage, while the joint technical paper provides hashes and network indicators that can support searches across endpoint records and retained logs during incident response and threat hunting.

Indicators of compromise (IoCs):-

File Hashes

All hashes and their roles above come from the joint technical paper.

Network and Host Indicators

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.