Full Report
Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources and energy.
Analysis Summary
# Threat Actor: UAT-6275
## Attribution & Identity
* **Name:** UAT-6275
* **Aliases:** TAG-193 (Recorded Future), Silent Lynx (Seqrite).
* **Known Associations:** Part of a broader activity cluster including **YoroTrooper**. Shares overlapping indicators with **Tomiris** (Kaspersky), **ShadowSilk** (Group-IB), **Cavalry Werewolf** (BI.ZONE), and **Hydra Saiga** (VMRay).
* **Nexus:** Kazakhstan (Medium confidence), based on infrastructure access, language artifacts, working hours, and regional targeting.
## Activity Summary
Observed activity from June 2025 through August 2026. The actor utilized four primary infection chains to deliver custom reverse shells. The discovery was aided by significant operational security (OPSEC) failures, including three publicly accessible staging directories and an exposed GitHub repository history, which revealed payload builds and tool inventories.
## Tactics, Techniques & Procedures
* **Initial Access:**
* Spearphishing with macro-enabled documents.
* Exploitation of **CVE-2025-8088** in WinRAR archives.
* **Execution:**
* PS2EXE downloaders.
* GitHub-hosted PowerShell scripts.
* Scheduled tasks and Startup folder modifications for persistence.
* **Post-Compromise:** Preparation for operations against Linux hosts and internet-facing appliances.
* **MITRE ATT&CK IDs:**
* T1566.001 (Spearphishing Attachment)
* T1204.002 (User Execution: Malicious File)
* T1059.001 (PowerShell)
* T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)
* T1053.005 (Scheduled Task/Job: Scheduled Task)
## Targeting
* **Sectors:** Government (Diplomacy, Economic Development, Agriculture, Environmental Management), Water Resources, Energy infrastructure.
* **Geography:** Commonwealth of Independent States (CIS) and Central Asia.
* **Victims:** Organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Specific activity noted involving Tajik and Belarusian government entities.
## Tools & Infrastructure
* **Malware Families:**
* PickleShell (Reverse shell)
* Chvost (Reverse shell)
* LAPLAS (Malware)
* Custom reverse shells and proxy tools.
* **Infrastructure:**
* GitHub for hosting malicious scripts.
* Publicly accessible staging directories.
* C2 Infrastructure: (Example defanged IOCs based on report context) `github[.]com/cisco-talos/IOCs/tree/main/2026/10` (Referenced for full list).
## Implications
UAT-6275 is a highly active regional espionage threat actor focused on gathering intelligence to inform bilateral negotiations, economic planning, and regional security decisions. Their interest in energy and water resources reflects the shifting geopolitical priorities in the CIS region following the Russia–Ukraine war. Despite OPSEC lapses, the actor demonstrates a sophisticated ability to pivot across platforms (Windows to Linux).
## Mitigations
* **Patch Management:** Immediately patch archive utilities, specifically addressing CVE-2025-8088.
* **Behavioral Monitoring:** Monitor for unexpected PowerShell activity and unauthorized downloads from public repositories like GitHub.
* **Persistence Detection:** Audit Scheduled Tasks and the Startup folder for unusual entries.
* **Security Solutions:** Implement Snort and ClamAV signatures (e.g., `Win.Backdoor.PickleShell-10060602-0`) to block known payloads.
* **Network Defense:** Utilize DNS and Email filtering to identify and block communication with known C2 infrastructure.