Kazakhstan-Nexus Group UAT-6275 Targets CIS Governments with Exploits
A threat group with suspected ties to Kazakhstan, known as UAT-6275, has been actively targeting government organizations across the Commonwealth of Independent States (CIS), with a particular focus on water resources and energy sectors.
Cisco Talos, in collaboration with Recorded Future's Insikt Group, has uncovered a sophisticated cyber-espionage campaign orchestrated by a threat actor designated UAT-6275, also tracked by Recorded Future as TAG-193. This group has been observed targeting government entities within the Commonwealth of Independent States (CIS) region, with a notable interest in sectors critical to regional stability, such as water resources and energy. The observed targeting patterns and lure themes suggest a potential motivation rooted in intelligence gathering, possibly influenced by the ongoing geopolitical ramifications of the Russia-Ukraine war.
Between June 2025 and August 2026, Talos identified four distinct infection chains employed by UAT-6275. These chains leverage a combination of social engineering tactics, including macro-enabled documents, PowerShell scripts disguised as executables (PS2EXE downloaders), and GitHub-hosted PowerShell payloads. A key element in their initial access strategy involves exploiting CVE-2025-8088 through specially crafted WinRAR archives. The group's arsenal includes several custom-developed reverse shells, providing them with interactive remote access to compromised systems.
In a significant operational security lapse, UAT-6275 exposed three publicly accessible staging directories and a GitHub repository. These exposed assets provided researchers with unprecedented visibility into the threat actor's internal operations, including their malware development processes, the tools they utilize, and ongoing changes to their command-and-control (C2) infrastructure. This direct insight allowed for the analysis of payload builds and revealed preparations for post-compromise activities, including potential operations against Linux hosts and internet-facing appliances.
Based on an analysis of infrastructure access, language artifacts found in samples, submission patterns, observed working hours, and regional targeting preferences, Talos assesses with medium confidence that UAT-6275 has a nexus to Kazakhstan. This assessment is further supported by the group's focus on CIS government organizations, which aligns with broader intelligence-gathering objectives in Central Asia.
The victimology of UAT-6275 is concentrated within Central Asia and the wider CIS region, spanning nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The targeted government institutions are involved in diplomacy, economic development, agriculture, and environmental management, suggesting an interest in information that could influence bilateral negotiations, economic planning, and regional security decisions.
Specific instances of targeting include activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan and a Belarusian government entity ahead of a bilateral meeting. Decoy documents recovered from the campaign also reflect this diplomatic and economic focus, featuring themes such as international trade and aviation, including a fake diplomatic letter addressed to Armenia's Ministry of Foreign Affairs.
The group's interest in water security and resource management is evident through observed activity targeting an Armenian environmental entity and Uzbekistan's Smart Forestry initiative. Energy-themed decoys, such as a proposal between Turkmenistan's state oil company and Russia's Orsk Oil Refinery, further underscore this focus. The timing of these lures, especially in relation to events like the shutdown of the Orsk Oil Refinery following a Ukrainian drone strike, suggests a keen interest in regional fuel supplies and the war's impact on energy security.
This campaign, previously reported as Silent Lynx by Seqrite and linked to broader activity clusters such as YoroTrooper, Tomiris, ShadowSilk, Cavalry Werewolf, and Hydra Saiga, highlights a persistent threat to governmental infrastructure in the CIS region. The continuous evolution and adaptation of UAT-6275's tactics, techniques, and procedures underscore the need for heightened vigilance and robust cybersecurity measures among targeted organizations.