Cisco Talos, in collaboration with Recorded Future’s Insikt Group, has uncovered a threat actor group named UAT-6275 (or TAG-193) targeting government organizations across the Commonwealth of Independent States (CIS). The group, which has ties to Kazakhstan, has been active since June 2025, with operations continuing through August 2026. The group’s activities span nine countries, including Kazakhstan, Kyrgyzstan, Tajikistan, and Russia, focusing on government institutions involved in diplomacy, economic development, and environmental management.
The group employs various infection chains, including macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and a crafted WinRAR archive exploiting CVE-2025-8088. Recovered payloads include custom reverse shells like Chvost, Laplas, and PickleShell, which provide interactive remote access. The group’s operational security lapses exposed staging directories and a GitHub repository, revealing malware development and infrastructure changes.
UAT-6275’s interests extend beyond government institutions to water resources and energy, likely driven by the regional effects of the Russia, Ukraine war. The group’s activities include targeting Tajik government entities post-treaty discussions with Kazakhstan and Belarusian entities ahead of bilateral meetings. Decoy documents suggest an interest in diplomatic relations, international trade, and aviation, with examples including a diplomatic letter to Armenia’s Ministry of Foreign Affairs and a cooperation proposal involving Turkmennebit and Orsk Oil Refinery.
Since Seqrite first reported Silent Lynx in January 2025, at least eight campaigns have been identified through May 2026. These campaigns include malware delivery, credential-harvesting sites, and lures referencing regional summits and energy infrastructure. The group’s infrastructure and malware delivery methods indicate a focus on expanding operational capabilities, including Linux-compatible tooling and a proof-of-concept exploit for FortiWeb CVE-2025-25257.