Cisco Talos and Recorded Future Say Kazakhstan-Nexus UAT-6275 Hit CIS Governments With GitHub-Staged Reverse Shells and a WinRAR Exploit

SINGAPORE - Cisco Talos and Recorded Future's Insikt Group said on Oct. 14, 2026 that a cyber-espionage group Talos tracks as UAT-6275 and Recorded Future tracks as TAG-193 has spent more than a year breaking into government organizations across the Commonwealth of Independent States, and that the group's own sloppy operational security gave researchers an unusually direct view of how it works. The companies say the activity overlaps with Silent Lynx, a name first used by Seqrite, and Talos places it within the broader set of campaigns connected to YoroTrooper, which Talos first reported in 2023, while still tracking the two separately because it has not seen direct indicator or toolset overlap. In activity observed from June 2025 through August 2026, Talos identified four infection-chain types built on macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell and a crafted WinRAR archive exploiting CVE-2025-8088. Three publicly accessible staging directories and the history of a previously unreported GitHub repository exposed payload builds, tool inventories and command-and-control changes. Talos assesses with medium confidence that the group has a Kazakhstan nexus. The full technical analysis and indicators are in a joint white paper for the Virus Bulletin 2026 conference, held Oct. 14 to 16 in Seville, Spain.

The targeting is tightly regional. Talos says observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus, with a focus on ministries handling diplomacy, economic development, agriculture and environmental management. The white paper says an IP address tied to a Tajik government entity responsible for economic development and trade policy beaconed to group infrastructure between March 18 and at least March 20, 2026, shortly after Kazakhstan's lower house ratified a treaty on allied relations with Tajikistan on March 11, and that a Belarusian agriculture-related government entity did the same from April 4 to at least April 7, about a week before an April 14 meeting in Astana. Recorded Future cautions that such timing does not establish that the intrusions were connected to those events. The researchers also observed activity involving an Armenian government entity responsible for environmental matters and Uzbekistan's Smart Forestry initiative. Recovered lures included a Russian diplomatic congratulatory letter addressed to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form, and an August 2025 decoy proposing cooperation between Turkmenistan's state oil company Turkmennebit and Russia's Orsk Oil Refinery. The group frequently sends spear-phishing emails from compromised government accounts, the paper says, including accounts tied to the governments of Tajikistan and Kyrgyzstan, and it ran at least one credential-harvesting site impersonating Azerbaijan's State Agency for Public Service and Social Innovations.

The four delivery chains show a steady progression. Chain A, first seen in June 2025, used a macro-enabled Word document whose AutoOpen routine downloaded shell.exe from 178.128.40[.]89 on port 8989, saved it as update.exe in the user's temp folder and ran it in a hidden window. Chain B, from July 2025, used PS2EXE, a tool that packages PowerShell scripts as standalone Windows executables, to fetch reverse shells and create scheduled tasks; the paper describes one task named WindowsUpdate that re-ran a VBScript launcher every six minutes and another named MicrosoftOfficeUpdate that ran the Chvost payload every 60 minutes. Chain C, first seen in October 2025, used a malicious shortcut that launched hidden PowerShell to pull a script from GitHub and run it in memory; later samples also dropped PickleShell into the Windows Startup folder. Chain D, identified in April 2026 and, according to Recorded Future, likely used against Armenia's Ministry of Foreign Affairs, was the first vulnerability exploit Talos has seen in the group's delivery. The RAR archive shows two decoy PDFs while hiding the payload in ten NTFS alternate data stream entries whose path traversals climb from a shallow AppData path up to ten parent directories, a reliability ladder that raises the odds one copy lands in the per-user Startup folder as rnsdtc.exe. On vulnerable WinRAR builds that gives the operator persistence at next sign-in without elevation, and the payload, which masquerades as the Windows Distributed Transaction Coordinator service, pipes a hidden cmd.exe session to 45.130.146[.]197 on port 80.

The tooling itself is deliberately small. The group relies on lightweight interactive reverse shells, including Laplas, Chvost and PickleShell, rather than full-featured implants. The white paper describes a previously undisclosed Laplas TLS variant that talks to licensing-mp-microsoft[.]serveexchange[.]com, a domain made to look like Microsoft Exchange infrastructure, and traces Chvost back to a June 2022 build that was uploaded to VirusTotal, apparently from Kazakhstan, 86 seconds after compilation. PickleShell, a C# .NET reverse shell first delivered around April 1, 2026, uses TLS with an unconditional certificate-validation bypass; the researchers say a .NET metadata GUID, be3a4a59-ef3d-4e1c-9501-b5f40be09217, stayed constant across all nine samples they observed even as the operator rotated file names from carnsvc to Rrnsvc to wcrnsvc, renamed classes, switched C2 encoding to Base64 and moved across at least six C2 endpoints. A sample from one of the open directories, at 104.248.17[.]222, 62.113.66[.]137 and 154.205.145[.]179, led researchers to the GitHub repository xzj4, active since Nov. 19, 2025, and the group's C2 infrastructure also held Linux ELF builds, Ligolo tunneling agents, Cobalt Strike, the open-source Exegol pentest framework, a public DLL-proxy generator and the public watchTowr proof-of-concept for FortiWeb CVE-2025-25257, though the researchers say they did not confirm in-the-wild FortiWeb exploitation. The paper also says the group set up a C2 listener on port 8443 of a compromised legitimate Russian GeoServer host on May 13, 2026. For attribution, Talos points to Russian-language artifacts, including a whoami command typed on a Russian keyboard layout, malware-testing submissions from Kazakhstan, and GitHub commit timing: 73 of 77 commits fall within 09:00 to 18:00 Astana time, compared with 39 of 77 in Moscow time. Recorded Future adds that the indicators do not establish the group's organizational affiliation or any state sponsorship.

For defenders, Talos recommends watching for unexpected PowerShell activity and payload downloads from public services such as GitHub, alongside new scheduled tasks and Startup-folder changes, and keeping archive utilities patched. Recorded Future adds monitoring for compromised email accounts, malicious content hosted on trusted public services and unexpected remote-access activity, and stresses protection for environmental agencies, forestry platforms, economic ministries and foreign affairs institutions. Talos has published ClamAV signatures for PickleShell, Chvost and Laplas, lists Snort 2 rules 1:11192, 1:15306, 1:46983 and 1:47398 and Snort 3 rules 1:46983 and 4:16, and has posted the indicators in its public GitHub IOC repository. Translated into SOC hunts, the reports point to concrete checks: executables written into a user's Startup folder by WinRAR, a file named rnsdtc.exe outside system directories, hidden PowerShell retrieving raw scripts from GitHub, scheduled tasks named WindowsUpdate or MicrosoftOfficeUpdate that do not match legitimate updaters, the PickleShell GUID in .NET binaries, and outbound sessions to dynamic DNS hostnames dressed up as Microsoft, Red Hat, Debian or CentOS update services.