Search — “UAT-6275”

Cisco Talos and Recorded Future Insikt Group report Kazakhstan-nexus (medium confidence) actor UAT-6275 targeting government bodies across CIS countries from June 2025 through August 2026, with interest in water and energy-related entities. Four infection chains use macro Word documents, PS2EXE downloaders creating scheduled tasks, GitHub-hosted PowerShell that provides remote shell access, and a RAR archive exploiting CVE-2025-8088 to place PickleShell in the Startup folder. Hunters should look for unexpected PowerShell fetching payloads from GitHub, new scheduled tasks, and Startup-folder changes.

Silent Lynx, tracked by Cisco Talos as UAT-6275 and by Recorded Future as TAG-193, ran four infection chains against CIS government organizations from June 2025 to August 2026. Chains used macro-enabled Word documents, PS2EXE downloaders that create scheduled tasks, LNK files in RAR archives launching PowerShell that fetches a GitHub-hosted script, and a RAR exploiting CVE-2025-8088 to drop PickleShell into the Windows Startup folder. Hunters should look for PowerShell or LNK-launched interpreters fetching from GitHub, new scheduled tasks created by PS2EXE-packaged executables, and new files in Startup folders.

Cisco Talos (UAT-6275) and Recorded Future Insikt Group (TAG-193) report at least eight campaigns since January 2025 against government agencies in nine countries, with medium-confidence ties to Kazakhstan. The group typically sends phishing emails with malicious attachments, sometimes from compromised government accounts, and in April 2026 exploited WinRAR CVE-2025-8088 to place malware in a Windows Startup folder. Hunters should look for WinRAR-extracted files written to Startup folders and for malicious scripts or files staged on GitHub.