Cisco Talos and Recorded Future identified four malware delivery methods and exposed infrastructure linked to the campaign, which researchers assess may have a Kazakhstan connection.
A threat group targeting government organizations across Central Asia and the Commonwealth of Independent States (CIS) has used four different methods to deliver malware, including a WinRAR vulnerability exploit, while leaving parts of its infrastructure publicly accessible, researchers at Cisco Talos and Recorded Future have found.
Talos tracks the activity as UAT-6275, while Recorded Future identifies it as TAG-193.
The exposed infrastructure revealed malicious scripts, malware builds and changes to command-and-control servers, giving researchers insight into the group’s operations and possible preparations for further attacks.
In a report published Oct. 14, Talos said the activity observed from June 2025 through August 2026 targeted government organizations in nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. The researchers also found evidence of interest in water resources, environmental management and energy infrastructure.
Talos assesses with medium confidence that the group has a Kazakhstan connection. The assessment is based on several indicators, including Russian-language artifacts, malware-testing activity apparently originating in Kazakhstan and the timing of activity consistent with local working hours.
Four routes to malware execution
The researchers identified four infection chains that show how the group’s delivery methods developed over time.
The earliest samples, observed in June 2025, used macro-enabled Word documents to download and execute additional malware. A month later, researchers found downloaders built with PS2EXE, a utility that packages PowerShell scripts as Windows executables. These downloaders retrieved remote-access payloads and created scheduled tasks to maintain persistence.
A third method, first observed in October 2025, used malicious Windows shortcuts to launch PowerShell commands that retrieved scripts hosted on GitHub. Later versions also installed PickleShell, a custom reverse shell, in the Windows Startup folder so it would run when a user logged in.
In April 2026, researchers identified a fourth method involving a crafted RAR archive that exploited CVE-2025-8088, a vulnerability in WinRAR. The archive placed PickleShell in the Startup folder, allowing the payload to execute at the next user sign-in. Talos said this was the first vulnerability exploit it had observed in the group’s malware delivery.
The group also used other custom reverse shells, including Chvost and Laplas. Such tools provide attackers with interactive remote access to compromised systems, allowing them to issue commands after gaining a foothold.
Publicly exposed tools reveal wider ambitions
Talos and Recorded Future discovered three publicly accessible staging directories containing the group’s malware and tools. One sample led to a previously unreported GitHub repository hosting malicious PowerShell scripts and payloads.
The repository’s history exposed changes to the group’s tools and command-and-control infrastructure. Researchers also recovered Linux-compatible tools and a publicly available proof-of-concept exploit for CVE-2025-25257, a vulnerability affecting FortiWeb.
These findings suggest the group may be preparing for activity beyond the Windows systems targeted by several of its documented infection chains. Talos said the recovered files indicated potential interest in Linux hosts and internet-facing appliances, although the report did not establish that these systems had been successfully compromised.
Government, diplomacy and energy in focus
The group’s targeting included institutions involved in diplomacy, economic development, agriculture and environmental management. Decoy documents referred to diplomatic relations, international trade and aviation, including a document impersonating a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs.
Network-flow analysis also identified activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026, and a Belarusian government entity ahead of a bilateral meeting in April. Talos said the timing could indicate an interest in regional diplomatic developments.
Other findings pointed to resource security. Researchers observed activity involving an Armenian government entity responsible for environmental matters and Uzbekistan’s Smart Forestry initiative. An earlier sample used a purported cooperation proposal between Turkmenistan’s state oil company, Turkmennebit, and Russia’s Orsk Oil Refinery.
Talos said the targeting was consistent with intelligence collection and could reflect the regional effects of the Russia-Ukraine war. The research does not establish who directed the activity or confirm a government sponsor.
The group overlaps with activity reported under the name Silent Lynx and appears to belong to a broader cluster associated with YoroTrooper, according to Talos. However, the researchers continue to track UAT-6275 separately because they have not found direct overlap in indicators or tools linking it to YoroTrooper.
For defenders, Talos recommends monitoring unexpected PowerShell activity, downloads of scripts and payloads from public services such as GitHub, and changes to scheduled tasks and Windows Startup folders. Keeping archive utilities patched can also reduce exposure to the WinRAR-based delivery method identified in the investigation.
Talos and Recorded Future published the research jointly, with the findings also summarized in a Virus Bulletin 2026 paper titled “Break the silence: tracking Silent Lynx through exposed infrastructure.”
