As cited
Copy frozen at (site build).
threat intel
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Cisco Talos and Recorded Future identified UAT-6275, a Kazakhstan-nexus threat group targeting Commonwealth of Independent States (CIS) government organizations from June 2025 through August 2026. The group uses macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and WinRAR archives exploiting CVE-2025-8088 to deliver custom reverse shells including Chvost, Laplas, and PickleShell. Exposed staging directories and GitHub repositories revealed the group's operational security lapses, malware development processes, and preparation for post-compromise and Linux targeting activities.
Why it matters: CIS government staff in diplomacy, energy, and environmental sectors should patch WinRAR immediately and monitor for unexpected PowerShell activity, GitHub payload downloads, and Startup folder modifications. Defenders supporting water resources, energy infrastructure, and government agencies across Central Asia need to assume active targeting and deploy detection rules for the identified malware families and command-and-control patterns.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Cisco Talos and Recorded Future identified UAT-6275, a Kazakhstan-nexus threat group targeting Commonwealth of Independent States (CIS) government organizations from June 2025 through August 2026. The group uses macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and WinRAR archives exploiting CVE-2025-8088 to deliver custom reverse shells including Chvost, Laplas, and PickleShell. Exposed staging directories and GitHub repositories revealed the group's operational security lapses, malware development processes, and preparation for post-compromise and Linux targeting activities.
Why it matters: CIS government staff in diplomacy, energy, and environmental sectors should patch WinRAR immediately and monitor for unexpected PowerShell activity, GitHub payload downloads, and Startup folder modifications. Defenders supporting water resources, energy infrastructure, and government agencies across Central Asia need to assume active targeting and deploy detection rules for the identified malware families and command-and-control patterns.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Cisco Talos and Recorded Future identified UAT-6275, a Kazakhstan-nexus threat group targeting Commonwealth of Independent States (CIS) government organizations from June 2025 through August 2026. The group uses macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and WinRAR archives exploiting CVE-2025-8088 to deliver custom reverse shells including Chvost, Laplas, and PickleShell. Exposed staging directories and GitHub repositories revealed the group's operational security lapses, malware development processes, and preparation for post-compromise and Linux targeting activities.
Why it matters: CIS government staff in diplomacy, energy, and environmental sectors should patch WinRAR immediately and monitor for unexpected PowerShell activity, GitHub payload downloads, and Startup folder modifications. Defenders supporting water resources, energy infrastructure, and government agencies across Central Asia need to assume active targeting and deploy detection rules for the identified malware families and command-and-control patterns.
- Source published
- First seen by Cybersecurity Tracker