UAT-6275 Hackers Exploit WinRAR Flaw in CIS Government Espionage Campaign

Threat actors tracked as UAT-6275 launched an espionage campaign targeting government organizations within the Commonwealth of Independent States. According to GBHackers, the group also focused on water, environmental, and energy sectors during operations running from June 2025 through April 2026.

The investigation revealed four active infection chains that delivered lightweight reverse shells to compromised Windows systems. These payloads provided operators with interactive access to target machines. Researchers noted that the group’s tactics evolved significantly over the course of the year, shifting from simple document macros to exploiting a specific software vulnerability.

Evolving Tactics and Infrastructure

The earliest chain, observed in June 2025, relied on macro-enabled Word documents to download and execute second-stage payloads. By July, Talos identified attackers using PS2EXE to convert PowerShell scripts into executable files. These downloaders retrieved malware and established persistence through scheduled tasks on the victim’s system.

In October 2025, a third chain emerged using malicious Windows shortcuts. These shortcuts launched PowerShell to retrieve and execute scripts hosted on GitHub. Later iterations of this method downloaded PickleShell, a custom reverse shell, and placed it in the Windows Startup folder to ensure the tool ran automatically upon user login.

The most significant operational change occurred in April 2026. Attackers crafted a malicious RAR archive that exploited CVE-2025-8088, a path-traversal vulnerability in WinRAR. This exploit allowed the group to write PickleShell directly into the user’s Startup folder without requiring elevated privileges, marking the first observed use of a vulnerability exploit in UAT-6275’s delivery chain.

Targeting and Tooling

Talos tracks this activity under the designation UAT-6275, while Recorded Future refers to the group as TAG-193. Researchers suggest the campaign’s regional focus may reflect intelligence priorities influenced by the ongoing effects of the Russia–Ukraine war. The group’s tools include custom reverse shells named Chvost, Laplas, and PickleShell, all designed for interactive command execution.

Investigators found three publicly accessible staging directories and a previously unreported GitHub repository on the group’s infrastructure. These resources exposed scripts, payloads, tool inventories, and changes to command-and-control servers. The repository’s commit history provided researchers with insight into the group’s development activity and infrastructure updates.

Materials recovered from the group’s infrastructure also indicated preparation for broader intrusions beyond Windows systems. Researchers found Linux-compatible tools and a public proof-of-concept exploit for CVE-2025-25257, a vulnerability in Fortinet FortiWeb, suggesting the group may be planning or testing attacks against different platforms and network security appliances.

What should you do?

Security teams should monitor for unusual PowerShell activity, particularly scripts executing from unexpected locations or launching from Windows shortcuts. Administrators must verify the integrity of Startup folders and scheduled tasks on endpoints, looking for unfamiliar executables or scripts that may indicate persistence mechanisms like PickleShell.

Organizations should assess their exposure to WinRAR by checking for updates that address CVE-2025-8088. Until a vendor provides a confirmed update, users should avoid opening unsolicited archive files and consider restricting the execution of macros in Office documents.

Network defenders should review logs for connections to known malicious staging directories or unusual outbound traffic to GitHub repositories. Teams handling sensitive government or infrastructure data should implement strict email filtering to block macro-enabled attachments and monitor for signs of interactive reverse shell connections.

What to do and how to stay safe: UAT-6275

• Inspect Windows Startup folders and scheduled tasks for unknown executables or scripts that may indicate persistence.
• Block or restrict the execution of macro-enabled Office documents from untrusted sources.
• Monitor network traffic for unexpected PowerShell processes or connections to public code hosting sites.
• Verify that WinRAR installations are updated to address path-traversal vulnerabilities like CVE-2025-8088.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What vulnerability did UAT-6275 exploit in WinRAR?

The group exploited CVE-2025-8088, a path-traversal vulnerability that allowed them to write malicious files to the user’s Startup folder.

Which sectors were targeted in this espionage campaign?

The campaign targeted government organizations, as well as the water, environmental, and energy sectors across the Commonwealth of Independent States.

What tools did the attackers use to maintain access?

Attackers used custom reverse shells named Chvost, Laplas, and PickleShell to maintain interactive access to compromised Windows systems.