Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

What it is

UAT-6275 (Recorded Future: TAG-193) is a suspected Kazakhstan-nexus espionage cluster overlapping Silent Lynx and, more loosely, YoroTrooper. Talos tracks YoroTrooper separately because it has seen no direct indicator or toolset overlap, though it assesses both likely belong to the same broader cluster. It targets government bodies in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Environmental, water and energy bodies are of particular interest. Attribution is medium confidence.

How it works

Talos sorted samples into four delivery chains by how they fetch and run payloads:

Chain D was the group's first observed vulnerability exploit. Payloads are lightweight custom reverse shells: Chvost, Laplas and PickleShell.

Staging directories and GitHub commit history also exposed:

• Linux-compatible tooling.
• A public proof-of-concept for FortiWeb CVE-2025-25257. The page says this suggests interest in Linux hosts and internet-facing appliances, but it records no observed use.

Preconditions / Affected

• Chains A and C need user interaction: opening a macro document or a shortcut.
• Chain D needs a vulnerable WinRAR. The page gives no fixed version, so check the CVE-2025-8088 advisory.
• Exposure is highest for CIS and Central Asian government, diplomatic, environmental, water and energy organizations. Timing correlated with diplomatic events: a Tajik entity after March 2026 treaty talks with Kazakhstan, and a Belarusian entity before an April bilateral meeting.

What to do

The page's own guidance:

• Monitor unexpected PowerShell activity.
• Monitor payload downloads from public services such as GitHub.
• Watch for new scheduled tasks and Startup-folder changes.
• Keep archive utilities (WinRAR) patched.

Available detections:

• ClamAV: Win.Backdoor.PickleShell-10060602-0, Win.Backdoor.Chvost-10060603-0, Win.Malware.Generic-10060604-0, Win.Malware.LAPLAS-10060605-0, Win.Malware.LAPLAS-10060606-0, Win.Proxy.Generic-10060628-0
• Snort 2: 1:11192, 1:15306, 1:46983, 1:47398
• Snort 3: 1:46983, 4:16
• IOCs: Talos publishes them in its GitHub repository. The full analysis is in the Virus Bulletin 2026 white paper "Break the silence: tracking Silent Lynx through exposed infrastructure".

Caveats

• The Kazakhstan nexus is medium confidence. It rests on Russian-language artifacts, apparent malware-testing submissions from Kazakhstan shortly after compilation, UTC+5 working hours, infrastructure access and regional targeting.
• Linking energy lures to Kazakhstan's fuel-supply interests is the authors' inference.
• The post does not say whether the FortiWeb exploit or the Linux tooling was used against any victim.