UAT-6275 Exploits WinRAR Flaw to Target CIS Government Agencies

The short version

• A threat group with a Kazakhstan nexus targeted government entities in the CIS region.
• Attackers used a combination of macro documents, PowerShell scripts, and a WinRAR exploit.
• Operational security failures allowed researchers to map the group's malware development.

The details

Cisco Talos and Recorded Future’s Insikt Group identified activity from UAT-6275, also tracked as TAG-193, targeting government organizations across the Commonwealth of Independent States. The campaign ran from June 2025 through August 2026 and affected nine countries, including Kazakhstan, Russia, and Belarus. The group focused on agencies handling diplomacy, economic development, agriculture, and environmental management. Recovered artifacts indicate a specific interest in water resources and energy sectors, which aligns with intelligence collection goals potentially linked to the Russia–Ukraine war.

The attackers employed four distinct infection chains. These included macro-enabled Word documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and a crafted WinRAR archive. The WinRAR method exploited CVE-2025-8088, a path traversal vulnerability. This flaw allowed malicious archives to write files outside the designated extraction folder. The group added this technique in April 2026, supplementing earlier attacks that relied on user interaction with macros or executable downloaders.

Exposure of three publicly accessible staging directories and a GitHub repository provided researchers with direct visibility into the group's operations. These leaks revealed payload builds, tool inventories, and changes to command-and-control infrastructure. The files suggest preparation for post-compromise operations, including potential activity against Linux hosts and internet-facing appliances. Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on infrastructure access, language artifacts, sample submissions, and working hours analysis.

The context

UAT-6275 overlaps with Silent Lynx and sits within a broader cluster connected to YoroTrooper. While researchers track them separately due to a lack of direct toolset overlap, they likely belong to the same activity family. Other groups in this cluster include Tomiris, ShadowSilk, Cavalry Werewolf, and Hydra Saiga. The timing of some intrusions coincided with diplomatic events, such as treaty discussions between Tajikistan and Kazakhstan in March 2026 and a bilateral meeting involving Belarus in April. Decoy documents included diplomatic letters and trade-related materials, suggesting an intent to gather information for regional security and economic planning.

What to watch

• Monitor for new indicators of compromise related to the exposed GitHub repositories.
• Watch for changes in the group's command-and-control infrastructure as they adapt to detection.
• Observe activity targeting Linux hosts and internet-facing appliances, as suggested by recovered files.

What it means for organisations

Operations teams must verify that archive utilities are updated and configured to prevent path traversal. Security leaders should assess whether current monitoring detects custom reverse shells masquerading as system services. Incident response plans need to account for persistent threats that activate at user sign-in rather than immediate execution. Communication protocols should ensure that IT, legal, and executive teams are aligned when state-aligned actors target sensitive diplomatic or energy data. Supplier risk assessments must include third-party repositories used for script hosting.

What to do and how to stay safe: UAT-6275

• Ensure all archive extraction tools are updated to versions that patch known path traversal vulnerabilities.
• Restrict the execution of PowerShell scripts from external or untrusted sources such as public code repositories.
• Monitor for unusual file writes in user Startup folders, which may indicate persistent malware installation.
• Review logs for connections to known command-and-control infrastructure associated with this threat actor.

Step-by-step guide: Secure Home Routers for Small Business Networks

General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific vulnerability did UAT-6275 exploit in WinRAR?

The group exploited CVE-2025-8088, a path traversal flaw that allows crafted archives to write files outside the chosen extraction folder.

What tools did the attackers use to maintain remote access?

Researchers identified custom reverse shells named PickleShell, Chvost, and Laplas, which provide interactive remote access to infected systems.

How did researchers gain visibility into the group's operations?

The group made operational security errors by leaving staging directories and a GitHub repository publicly accessible, exposing their tools and infrastructure.