Cisco Talos Links UAT-6275 to Kazakhstan, Targets CIS Government Agencies

Cisco Talos and Recorded Future’s Insikt Group report that the threat actor UAT-6275 is targeting government organizations across the Commonwealth of Independent States. The joint investigation, detailed in a Virus Bulletin 2026 white paper, links the group to Kazakhstan and highlights its focus on water resources and energy sectors. This activity was observed from June 2025 through August 2026, with victims spanning nine countries including Russia, Belarus, and Kazakhstan.

The researchers identified four distinct infection chains used by the group. These methods include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and a crafted WinRAR archive that exploits CVE-2025-8088. Once inside, the attackers deploy custom reverse shells to establish interactive remote access. The recovered payloads suggest the group is preparing for post-compromise operations, including potential activity against Linux hosts and internet-facing appliances.

Operational Security Lapses Reveal Tactics

Three publicly accessible staging directories and GitHub repository history exposed critical details about the group’s operations. These operational security lapses allowed researchers to view payload builds, tool inventories, and changes to command-and-control infrastructure. Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, citing infrastructure access, language artifacts, sample submissions, and working hours analysis. The group also overlaps with Silent Lynx and sits within a broader cluster connected to YoroTrooper, though direct toolset overlap has not been confirmed.

Targeting Diplomacy and Regional Resources

UAT-6275 focuses on government institutions responsible for diplomacy, economic development, agriculture, and environmental management. Network flow analysis showed activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026. Similarly, a Belarusian government entity was targeted ahead of a bilateral meeting in April. Decoy documents recovered by the researchers included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, indicating an interest in international trade and aviation relations.

What should you do?

Organizations in the CIS region, particularly those in government, energy, or water sectors, should monitor for unusual PowerShell activity and macro-enabled document downloads. Security teams should review GitHub repositories for exposed staging directories or malicious scripts. Administrators should ensure WinRAR is updated to mitigate CVE-2025-8088 and inspect reverse shell connections. Once the vendor provides an update for any exploited software, apply it immediately.

What to do and how to stay safe: Cisco Talos

• Monitor network traffic for connections to known command-and-control infrastructure or unusual PowerShell execution.
• Review GitHub repository history and staging directories for exposed artifacts or malicious script hosting.
• Ensure WinRAR and other archive utilities are updated to protect against CVE-2025-8088 exploitation.
• Inspect systems for custom reverse shells and unauthorized remote access tools following any compromise.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which countries are being targeted by UAT-6275?

The group targets organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

What vulnerabilities is the group exploiting?

The group uses a crafted WinRAR archive exploiting CVE-2025-8088, along with macro-enabled documents and PowerShell scripts.

Is UAT-6275 linked to other threat groups?

Yes, it overlaps with Silent Lynx and is part of a broader cluster connected to YoroTrooper, though direct toolset overlap is unconfirmed.