Full Report
Explore joint Cisco Talos and Recorded Future research on TAG-193's cyber-espionage operations targeting government across Central Asia and the wider Commonwealth of Independent States (CIS)
Analysis Summary
# Threat Actor: TAG-193
## Attribution & Identity
- **Name/Alias:** TAG-193, UAT-6275 (Cisco Talos), Silent Lynx.
- **Attribution:** Assessed as likely operating from **Kazakhstan**.
- **Evidence for Attribution:** Russian-language artifacts, malware-testing submissions originating from Kazakhstan, and activity patterns aligning with Kazakhstan’s standard working hours.
- **Affiliation:** Organizational affiliation or specific state sponsorship remains unresolved.
## Activity Summary
The article details sustained cyber-espionage operations spanning from **early 2025 through May 2026**. TAG-193 focuses on intelligence collection related to regional diplomacy, economic planning, and natural resource management (specifically water and forestry) within the CIS region. Operations often coincide with high-level bilateral meetings and treaty considerations.
## Tactics, Techniques & Procedures
- **Initial Access:**
- Spearphishing using compromised government email accounts to send credible lures.
- Exploitation of public-facing services (e.g., potential interest in FortiWeb exploits).
- **Execution & Persistence:**
- Use of interactive reverse shells for command execution.
- Abuse of trusted public platforms like **GitHub** to host malicious scripts and second-stage payloads.
- **Evasion:**
- Blending into routine government workflows by using official-looking documents (diplomatic letters, airspace applications).
- **MITRE ATT&CK IDs:**
- Phishing: Spearphishing Attachment [T1566.001]
- Command and Scripting Interpreter: PowerShell [T1059.001]
- Web Service: Bidirectional Communication [T1102.002] (Abuse of GitHub)
- Exploitation for Client Execution [T1203]
## Targeting
- **Sectors:** Government (Diplomacy, Economy, Agriculture), Environmental Management, Forestry, Energy, and Water Resource organizations.
- **Geography:** Central Asia and the Commonwealth of Independent States (CIS).
- **Victims:**
- **Russia:** Government entities and the Orsk Oil Refinery.
- **Tajikistan:** Economic development government entity.
- **Belarus:** Agriculture-related government entity.
- **Armenia:** Ministry of Foreign Affairs and environmental agencies.
- **Uzbekistan:** "Smart Forestry" initiative infrastructure.
## Tools & Infrastructure
- **Malware:**
- **LAPLAS**
- **FoalShell** (multiple variants)
- PowerShell-based reverse shells
- **Infrastructure:**
- **GitHub:** Used for staging and hosting payloads (e.g., undocumented staging accounts).
- **C2/Domains:** Defanged infrastructure includes:
- `hxxps[://]github[.]com/` (Staging/Payload hosting)
- Mention of exposed directories on actor-controlled infrastructure used for tool testing.
- **Vulnerabilities:** Interest in **FortiWeb** exploits.
## Implications
TAG-193 represents a specialized regional threat focused on the "soft underbelly" of national security—resource management. Their focus on water security and environmental data highlights the strategic value of non-military data in Central Asia, where resource scarcity can dictate geopolitical leverage. Their ability to compromise and use official government email accounts poses a significant trust-based risk to regional diplomatic communications.
## Mitigations
- **Email Security:** Implement robust DMARC/SPF/DKIM configurations and monitor for anomalies in internal-to-external and government-to-government email flows to detect compromised accounts.
- **Network Monitoring:** Monitor for unauthorized outbound connections to public code repositories (like GitHub) that exhibit patterns of command-and-control or payload retrieval.
- **Vulnerability Management:** Prioritize patching of edge appliances, specifically Fortinet FortiWeb devices, as the group has shown interest in these attack vectors.
- **Sector-Specific Defense:** Increase security posture for non-traditional targets like ministries of agriculture and environmental agencies, which may not historically be hardened like defense or interior ministries.