- Cisco Talos and Recorded Future found that UAT-6275, which targets CIS governments, used a WinRAR exploit (CVE-2025-8088) in April 2026. It is the first exploit Talos has seen it use.
- The group left three staging directories and a GitHub repository open. Researchers could see its tools and infrastructure changes. The report names no victims of the WinRAR chain.
- Teams should patch archive utilities. They should also alert on PowerShell downloads from public services, new scheduled tasks and Startup-folder changes.
The most useful thing a spy group left behind was not a stolen file. It was its own workshop. Cisco Talos worked with Recorded Future's Insikt Group and found three open staging directories. They also found a GitHub repository the group used to host its tools. Together these showed how the group builds and changes its malware. The lesson for defenders is plain. The first exploit Talos saw this group use targeted an ordinary file-compression tool.
What the researchers found
Talos tracks the group as UAT-6275. Recorded Future calls it TAG-193. It overlaps with Silent Lynx, which Seqrite first reported in January 2025.
Talos assesses with medium confidence that the group has a Kazakhstan nexus. It points to Russian-language artifacts and malware test submissions from Kazakhstan. It also cites working hours that fit UTC+5.
The open servers held malware, tool inventories and a record of changes to command-and-control infrastructure. That is the set of servers that send orders to infected machines. Talos called these operational security lapses. They gave its team a direct view of the group's recent work.
Four ways in, and one that is different
Talos sorted the recovered samples into four infection chains. Each is a different way to put a small remote-control program on a victim's computer.
Chain A appeared in June 2025. It used Word documents with macros, which are small programs embedded in a file. Chain B followed in July 2025. It used downloaders built with PS2EXE, a tool that turns a PowerShell script into a standalone Windows program. Those downloaders also created scheduled tasks, so the malware kept running after a restart.
Chain C first showed up in October 2025. A malicious shortcut started PowerShell, and PowerShell fetched a script hosted on GitHub. Later samples also installed PickleShell in the Windows Startup folder. A reverse shell like PickleShell calls out to the attacker. It then lets the attacker type commands on the victim's machine.
Chain D dates from April 2026. Talos found a specially crafted RAR archive that abuses CVE-2025-8088, a flaw in WinRAR. The archive places PickleShell in the Startup folder. The payload then starts the next time the user signs in.
Talos calls this the first vulnerability exploit it has seen in the group's delivery methods. The report names no victims of Chain D.
Why the archive tool matters
The first three chains lean on social engineering. A person has to enable a macro or open a shortcut. Chain D adds a software flaw to the mix.
Some general background follows. It is not a detail from the report, which does not explain how this flaw works or how the archive reaches its target. Such exploits generally need the target to open the file. Flaws in archive tools can also let a crafted file write content to a folder the user never chose. A Startup folder is one place an attacker would want that to happen.
Here is the argument. Archive tools are easy to overlook in patch inventories. Teams track operating systems and browsers closely. A small utility installed years ago may get less attention. Talos does not make that claim. It says only that keeping archive utilities patched can reduce exposure to this method.
This is one exploit in one campaign. It is not evidence of a wider trend.
Talos also recovered Linux-compatible tools from the group's servers. Next to them sat a public exploit for CVE-2025-25257. That is an SQL injection flaw in Fortinet FortiWeb, which means attackers can slip database commands into a web application. Talos reads the find as a sign the group may be widening its capabilities. It does not say the exploit was used.
Who carries the risk
The group goes after government bodies that handle diplomacy, economic development, agriculture and environmental management. These bodies hold information that can shape negotiations and planning.
Talos ties some activity to the diplomatic calendar. Its network analysis linked a Tajik government body to the group soon after March 2026 talks with Kazakhstan on a treaty. Activity at a Belarusian government body came before a two-country meeting in April. Talos says this timing may point to an interest in regional diplomacy.
Since Seqrite's January 2025 report, Talos has counted at least eight campaigns in the region, up to May 2026. Decoy documents included a diplomatic letter addressed to Armenia's Ministry of Foreign Affairs. Another was a cooperation proposal involving Russia's Orsk Oil Refinery.
The Hacker News reported that the phishing emails are sent from compromised government accounts and carry official-looking documents. The people who open such files are officials doing their jobs. They are not careless users.
Questions to put to your team
Most readers do not work in Central Asian ministries. The method still matters to any organization with Windows desktops.
First, ask whether every archive utility is inventoried and patched against CVE-2025-8088. That covers managed and unmanaged machines.
Second, ask what raises an alert when PowerShell downloads a payload from a public service such as GitHub. Talos advises watching for this. It also names new scheduled tasks and changes to the Startup folder.
Third, ask whether any FortiWeb appliances are exposed to the internet. If so, ask whether CVE-2025-25257 has been addressed.
This group's own mistakes let researchers read its playbook. Few attackers will do the same. A sound defence starts with knowing which ordinary tools you run and keeping them current.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cisco Talos.
