Researchers detail CIS espionage cluster and WinRAR flaw

Talos and Recorded Future say UAT-6275, also TAG-193, phished CIS governments and abused WinRAR CVE-2025-8088, with a medium-confidence Kazakhstan link.

Cisco Talos and Recorded Future’s Insikt Group report espionage against government organizations in Central Asia and the CIS by a cluster tracked as UAT-6275 and TAG-193 and associated with Silent Lynx. Sources disagree on timing and scope: Recorded Future describes activity from early 2025 through May 2026 involving Russia, Tajikistan, Belarus, Armenia, and Uzbekistan; Talos, Cyber Security News, and The Hacker News say June 2025 through August 2026 across nine CIS countries; The Record counts at least eight campaigns since January 2025; Security Affairs says the group has been active since at least 2024 and also targeted Russia’s Orsk Oil Refinery and the Nizhny Novgorod government. Operators phished with malicious documents, sometimes from compromised government accounts—including Tajik and Kyrgyz mail, according to Security Affairs—and staged payloads on GitHub and, per that report, Telegram and hijacked servers, using macros, PS2EXE downloaders, shortcuts, scheduled tasks, and custom reverse shells named LAPLAS or Laplas, FoalShell, Chvost, PickleShell, and PowerShell. In April 2026 a chain likely aimed at Armenia’s foreign ministry exploited WinRAR CVE-2025-8088; Cyber Security News says crafted archives dropped PickleShell into the Windows Startup folder. Talos assesses a Kazakhstan nexus with medium confidence, without confirmed sponsorship, and links the cluster to Silent Lynx and broader YoroTrooper activity while tracking them separately, whereas Recorded Future and The Hacker News treat Silent Lynx as the same actor and Security Affairs also overlaps it with ShadowSilk and Hydra Saiga while calling the motive unproven. Cited interests include diplomacy, economics, energy, water, forestry, and the environment; FortiWeb exploitation was not confirmed, though The Hacker News says staging held a proof of concept for CVE-2025-25257.

• The cluster is tracked as UAT-6275 and TAG-193 and associated with Silent Lynx; Talos also links it to broader YoroTrooper activity while tracking them separately, and Security Affairs adds overlap with ShadowSilk and Hydra Saiga.
• Timing differs: Recorded Future says early 2025 through May 2026; Talos, Cyber Security News, and The Hacker News say June 2025 through August 2026; The Record counts at least eight campaigns since January 2025; Security Affairs says…
• Targets are government organizations across as many as nine CIS countries, including Russia, Tajikistan, Belarus, Armenia, and Uzbekistan; Security Affairs also names Russia’s Orsk Oil Refinery and the Nizhny Novgorod government.