Cisco Talos said on 14 October that it has tracked a hacking group called UAT-6275, which goes after government bodies in the Commonwealth of Independent States (CIS). Recorded Future's Insikt Group worked on the research and calls the group TAG-193. Talos found at least eight campaigns between January 2025 and May 2026. Victims and bait themes touch nine countries, including Kazakhstan, Armenia, Russia and Belarus. Talos also found three open staging folders and a GitHub repository where the group kept its scripts. It sorted the malware into four infection chains. The newest, seen in April 2026, used a WinRAR flaw, CVE-2025-8088.
Talos says with medium confidence that the group has a Kazakhstan link. It points to Russian-language files, test uploads from Kazakhstan, and work hours that fit UTC+5. Talos thinks the group likely belongs to the same wider cluster as YoroTrooper, but tracks them apart because it saw no direct overlap in tools or indicators. The timing of some activity may show interest in diplomacy, Talos said. The post does not say how many victims were breached or what data, if any, was taken.
Talos advises defenders in these sectors to watch for unexpected PowerShell use, downloads from public services such as GitHub, new scheduled tasks and changes to the Windows Startup folder. It also says keeping archive tools like WinRAR patched can cut exposure to the exploit used here.