Open staging directories and GitHub history expose UAT-6275's four-chain campaign against CIS governments
Cisco Talos and Recorded Future tie a June 2025 to August 2026 campaign against CIS governments to UAT-6275. Talos rates its Kazakhstan nexus at medium confidence, and Recorded Future tracks the same activity as TAG-193.
The Watch · Security desk
Timeline. June 2025: observed UAT-6275 activity begins. March 2026: treaty talks with Kazakhstan, with Tajik government entity activity shortly after. April 2026: a bilateral meeting, with Belarusian government entity activity ahead of it. August 2026: observed activity ends.
| Date | Event | Claim |
|---|---|---|
| June 2025 | Start of UAT-6275 activity Talos observed | 2 |
| March 2026 | Kazakhstan treaty talks; Tajik activity after | 12 |
| April 2026 | Bilateral meeting; Belarusian activity before it | 12 |
| August 2026 | End of the observed activity | 2 |
What happened
- Talos identified four ways in: documents carrying macros, downloaders built with PS2EXE, PowerShell scripts hosted on GitHub, and a WinRAR archive crafted to exploit CVE-2025-8088.
- Recovered payloads include several custom reverse shells that give the operators interactive remote access to infected machines.
- Payload builds, tool inventories and command-and-control infrastructure changes were left visible in three staging directories open to the public and in GitHub repository history.
- The victims and lure themes Talos saw cover nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.
- Talos bases its Kazakhstan-nexus call on infrastructure access, language artifacts, sample submissions, working hours analysis and regional targeting interests.
Why it matters
- exposure Talos reads the recovered files as preparation for post-compromise work and possible activity against Linux hosts and internet-facing appliances, so Windows-only monitoring covers part of what the group appears to be building.
- decision Teams hunting from YoroTrooper indicators must decide whether to extend them to UAT-6275. Talos keeps the two separate because it has seen no direct indicator or toolset overlap, though it thinks they likely share a broader cluster.
- precedent Talos first reported YoroTrooper in 2023, and five other vendors have published overlapping cluster names since. Older reports under those names may describe the same operators.
- constraint The nine-country figure counts victims and lure themes together, so it cannot be read as a count of compromised countries.
Three of the four chains are named by technique, and only the WinRAR chain carries a CVE in Talos's summary [18]. That puts the weight on the lure. The decoys Talos recovered are specific: a diplomatic letter addressed to Armenia's Ministry of Foreign Affairs [13] and a cooperation proposal between Turkmenistan's state oil company, Turkmennebit, and Russia's Orsk Oil Refinery [14].
Activity also tracks the diplomatic calendar. Talos's network flow analysis picked up activity tied to a Tajik government entity soon after treaty talks with Kazakhstan in March 2026, and to a Belarusian government entity in the run-up to a bilateral meeting in April [12]. Talos says that timing may indicate an interest in regional diplomatic developments [12]. Kazakhstan is on the nine-country list [7] as well as being the assessed nexus [6].
The water and energy evidence is thinner than the government evidence. Talos frames it as interest shown in recovered artifacts [1]. Its examples are an Armenian government entity responsible for environmental matters and Uzbekistan's Smart Forestry initiative [15], plus the Turkmennebit decoy [14]. Talos calls the wider focus consistent with intelligence collection and says it may reflect the regional effects of the Russia-Ukraine war [16].
The full technical analysis and indicators of compromise are in the joint Virus Bulletin 2026 white paper, "Break the silence: tracking Silent Lynx through exposed infrastructure" [17]. Talos did the research with Julian-Ferdinand Vögele of Recorded Future's Insikt Group [8].
What to watch
- Whether Talos or other vendors find direct indicator or toolset overlap between UAT-6275 and YoroTrooper that would merge the tracking.
- Whether payloads aimed at Linux hosts or internet-facing appliances turn up in the wild, since the exposed files point toward them.
- Whether the group changes its staging and GitHub practice now that its builds and C2 changes have been published.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States, and recovered artifacts show additional interest in water resources and energy.
- [2]
In activity observed from June 2025 through August 2026, Talos identified four infection-chain types using macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088.
- [3]
Recovered payloads include several custom reverse shells that provide interactive remote access.
- [4]
Three publicly accessible staging directories and GitHub repository history exposed payload builds, tool inventories, and changes to command-and-control infrastructure; Talos calls these operational security lapses that gave it direct visibility into recent activity.
- [5]
Files recovered from the exposed infrastructure suggest preparation for post-compromise operations and potential activity against Linux hosts and internet-facing appliances.
- [6]
Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on infrastructure access, language artifacts, sample submissions, working hours analysis, and regional targeting interests.
- [7]
Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
- [8]
The research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future's Insikt Group.
- [9]
Talos tracks the activity as UAT-6275 and Recorded Future tracks it as TAG-193. It overlaps with Silent Lynx (first reported by Seqrite) and sits within a broader set of campaigns connected to YoroTrooper, which Talos first reported in 2023.
- [10]
Subsequent research on Tomiris (Kaspersky), ShadowSilk (Group-IB), Cavalry Werewolf (BI.ZONE), and Hydra Saiga (VMRay) identified overlapping indicators across these reported clusters.
- [11]
Talos assesses that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster, but tracks them separately because it has not observed direct indicator or toolset overlap between the two.
- [12]
Talos's network flow analysis identified activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026 and a Belarusian government entity ahead of a bilateral meeting in April; Talos says this timing may indicate an interest in regional diplomatic developments.
- [13]
Recovered decoy documents include a diplomatic letter addressed to Armenia's Ministry of Foreign Affairs.
- [14]
Energy-themed decoys included a cooperation proposal between Turkmenistan's state oil company, Turkmennebit, and Russia's Orsk Oil Refinery.
- [15]
Talos observed activity involving an Armenian government entity responsible for environmental matters and Uzbekistan's Smart Forestry initiative.
- [16]
The group's focus is consistent with intelligence collection and may reflect the regional effects of the Russia-Ukraine war.
- [17]
The post summarizes the joint Virus Bulletin 2026 white paper, "Break the silence: tracking Silent Lynx through exposed infrastructure", which contains the full technical analysis and indicators of compromise.
- [18]
Only one of the four infection chains is tied to a CVE in Talos's summary; the other three are named by technique.
- [19]
Five vendors other than Talos have published names for clusters that overlap with UAT-6275 or YoroTrooper.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- blog.talosintelligence.comBreak the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
1 article · October 14, 2026
- recordedfuture.comTAG-193’s Regional Espionage Operations
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Malware AnalysisFollow
- Threat Intelligence and Incident ResponseFollow
- State-sponsored espionageFollow
Entities
- CVE-2025-8088Follow
- YoroTrooperFollow
- UAT-6275Follow
- CVE-2025-25257Follow
- Recorded FutureFollow
- Cisco TalosFollow