UAT-6275 Campaign Targets CIS Government and Energy

Cisco Talos, working with Recorded Future’s Insikt Group, has documented a sustained intrusion campaign aimed at government organizations across the Commonwealth of Independent States (CIS). The activity, tracked by Talos as UAT-6275 and by Recorded Future as TAG-193, has also touched organizations connected to water resources, environmental management, and energy.

The research covers activity observed from June 2025 through August 2026. Talos recovered multiple delivery chains, custom reverse shells, publicly exposed staging infrastructure, and a previously unreported GitHub repository containing malicious scripts and payloads. The exposed material gave researchers an unusual view of the group’s development process and infrastructure changes.

Talos assesses with medium confidence that the activity has a Kazakhstan nexus. That is an assessment rather than a confirmed attribution. The organization cites Russian-language artifacts, apparent malware-testing submissions from Kazakhstan, operator activity consistent with UTC+5 working hours, infrastructure access, and regional targeting interests as supporting evidence.

Who and what the campaign targets

Observed targeting spans nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The affected or targeted organizations described by Talos include government bodies responsible for diplomacy, economic development, agriculture, environmental management, and related resource programs.

The victimology suggests an intelligence-collection focus. Decoys referenced diplomatic correspondence, international trade, aviation, regional summits, and cooperation involving energy companies. Talos also observed activity involving an Armenian environmental organization and Uzbekistan’s Smart Forestry initiative. Earlier reporting associated with the broader activity set had identified interest in water-resource organizations across Central Asia.

Some observations occurred close to regional diplomatic events. Talos identified network activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026 and activity involving a Belarusian government entity before a bilateral meeting in April. The timing may indicate interest in diplomatic developments, but it does not by itself establish the operator’s purpose or identity.

Energy-related lures included a purported cooperation proposal involving Turkmenistan’s state oil company, Turkmennebit, and Russia’s Orsk Oil Refinery. Talos interprets these themes as potentially consistent with intelligence interest in regional fuel supplies and the effects of the Russia–Ukraine war on Kazakhstan’s energy security. That interpretation remains a researcher assessment.

Four delivery chains, changing over time

Talos grouped recovered samples into four infection chains based on how they retrieved and executed payloads. The progression shows an operator using several common delivery mechanisms rather than relying on one fixed method.

Chain A: macro-enabled documents

The earliest samples, observed in June 2025, used macro-enabled Microsoft Word documents. When opened and enabled in the relevant execution context, the documents downloaded and ran a second-stage binary. The supplied research does not specify the exact lure-delivery channel, the macro’s implementation, or the identity of the recipients.

Chain B: PS2EXE-packaged downloaders

In July 2025, Talos observed downloaders built with PS2EXE, which packages PowerShell scripts as standalone Windows executables. These downloaders retrieved reverse-shell payloads and created scheduled tasks for persistence. The research identifies the persistence mechanism but does not provide a complete task configuration or a universal naming pattern.

Chain C: shortcut files and GitHub-hosted PowerShell

First observed in October 2025, this chain used a malicious shortcut to launch PowerShell. PowerShell then retrieved and executed a script hosted on GitHub. Later samples also downloaded PickleShell and placed it in the Windows Startup folder, causing the payload to run at the next user sign-in.

The use of a widely used public code-hosting service is important for defenders because it can blend malicious retrieval into legitimate administrative or developer traffic. At the same time, a GitHub dependency creates opportunities for monitoring unusual PowerShell activity, unexpected script retrieval, and access to repositories or paths not associated with an organization’s normal business processes.

Chain D: WinRAR exploitation

In April 2026, Talos identified a RAR archive that exploited CVE-2025-8088 in WinRAR to place PickleShell in the Windows Startup folder. The payload was designed to execute at the next user sign-in. Talos describes this as the first vulnerability exploit observed in UAT-6275’s malware delivery.

The research also reports that UAT-6275 infrastructure contained a publicly available proof-of-concept exploit for FortiWeb CVE-2025-25257. Its presence suggests interest in expanding operational capabilities, but the supplied findings do not confirm that UAT-6275 used this material in a successful intrusion. Organizations should therefore treat the FortiWeb reference as an exposure indicator and patch-management concern, not as proof of exploitation by this campaign.

Payloads, persistence, and command activity

The recovered payloads include lightweight custom reverse shells named Chvost, Laplas, and PickleShell. Talos says these tools provide interactive remote access to compromised systems. The observed persistence mechanisms include scheduled tasks and the Windows Startup folder.

The available findings do not establish the full post-compromise sequence, the commands issued during every intrusion, or the data accessed or removed from victim environments. However, files recovered from exposed infrastructure suggest preparation for post-compromise operations and possible activity against Linux hosts and internet-facing appliances. Talos also recovered Linux-compatible tooling. These artifacts indicate areas of interest, not confirmed successful operations against those systems.

Three publicly accessible staging directories and the GitHub repository exposed payload builds, tool inventories, and changes to command-and-control infrastructure. Repository commit history helped researchers follow malware development and infrastructure changes. This visibility reflects an operational-security failure by the actor, but it should not be interpreted as evidence that all campaign infrastructure remains exposed or that the infrastructure is safe to access.

Attribution and relationship to other clusters

Talos says the activity overlaps with Silent Lynx, a cluster first reported by Seqrite, and sits within a wider set of campaigns connected to YoroTrooper. Research on Tomiris, ShadowSilk, Cavalry Werewolf, and Hydra Saiga also identified overlapping indicators across reported clusters.

Talos assesses that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster. The two are nevertheless tracked separately because researchers have not observed direct indicator or toolset overlap between them. This distinction matters: shared regional interests or related indicators can support clustering, but they do not independently prove common control or a single actor.

The Kazakhstan assessment is similarly qualified. Talos assigns medium confidence, based on several converging observations, while the supplied research does not identify a confirmed government sponsor or make a definitive national attribution.

Detection and hunting priorities

Defenders in government, energy, environmental, and water-resource organizations should prioritize visibility across email, endpoint, identity, network, and cloud-service logs. Useful review areas include:

• Unexpected execution of macros in Word documents, particularly from externally sourced files or directories that do not normally contain business documents.
• PowerShell launched by shortcut files, unfamiliar executables, or office applications.
• PowerShell retrieving scripts or payloads from GitHub or other public services without a documented administrative or development purpose.
• New or modified scheduled tasks associated with downloaders, script interpreters, or unusual user contexts.
• Changes to Windows Startup folders, especially when followed by a new binary or script appearing on the same host.
• RAR or other archive attachments involving WinRAR versions that may be exposed to CVE-2025-8088.
• Interactive outbound connections from workstations or servers that are inconsistent with their normal role, including connections initiated soon after document or archive execution.
• Unexpected tooling or shell activity on Linux systems and internet-facing appliances.

Talos lists ClamAV signatures for PickleShell, Chvost, Laplas, and related generic detections, as well as Snort 2 and Snort 3 rules covering the threat. Security teams using those products should validate that the relevant signatures and rules are available in their environment and confirm that alerts are reaching the appropriate monitoring workflow. The research does not establish coverage for every sample or every variant.

What organizations should do now

1. Patch archive utilities. Confirm that WinRAR and other archive-handling software are maintained through the organization’s normal vulnerability-management process, with priority given to systems that process externally supplied archives. Specifically assess exposure to CVE-2025-8088.
2. Constrain script execution. Apply appropriate PowerShell logging and application-control policies. Review whether users who do not need PowerShell can be prevented from launching it, while accounting for operational requirements.
3. Monitor public-service downloads. Establish visibility into script and payload retrieval from GitHub and similar services. Investigate unusual destinations in context rather than blocking all legitimate developer or administrative use.
4. Audit persistence locations. Regularly inspect scheduled tasks and Startup folders for newly introduced or unexplained entries, especially after suspicious document, shortcut, or archive activity.
5. Strengthen document and archive controls. Use email and endpoint controls to reduce exposure to macro-enabled documents, suspicious shortcuts, and archives from untrusted sources. User training should reinforce independent verification of diplomatic, trade, energy, and government-themed requests.
6. Protect high-value infrastructure. Separate administrative access to government, energy, water, and environmental systems from ordinary user workstations where practical. Review outbound access from internet-facing appliances and critical servers.
7. Investigate regionally relevant lures. Security operations teams should search historical telemetry for themes involving diplomatic meetings, bilateral cooperation, energy infrastructure, agriculture, forestry, and environmental programs, without assuming that a lure’s apparent sender is authentic.

Conclusion

UAT-6275 demonstrates how a regional espionage-oriented campaign can combine familiar Windows delivery methods with lightweight custom remote-access tools and public hosting services. The campaign’s evolution—from macro-enabled documents and PS2EXE downloaders to GitHub-hosted PowerShell and a WinRAR exploit—creates several defensive opportunities. Talos’s findings also show the value of monitoring persistence changes, public-service downloads, archive handling, and infrastructure-specific anomalies together rather than treating each event in isolation.

The campaign’s targeting and Kazakhstan nexus remain assessments, not definitive attribution. Organizations in the CIS and sectors tied to diplomacy, energy, water, and environmental management should use the reported behaviors as a basis for focused hunting, patch validation, and improved control over script, archive, and startup execution.

Sources

• Cisco Talos: Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations