Suspected Kazakhstan-linked UAT-6275 hackers target Central Asian and CIS governments, research finds

TLDR

• Cisco Talos and Recorded Future report an espionage cluster, UAT-6275, targeting government organisations across Central Asia and the CIS.¹²
• Exposed tooling and a first observed exploit of WinRAR flaw CVE-2025-8088 give defenders concrete material to hunt for.¹²
• Talos assesses with medium confidence that the group has a Kazakhstan nexus.¹

Talos said it identified UAT-6275 activity targeting government bodies across the CIS, with recovered artefacts showing additional interest in water resources and energy.¹ Across the reviewed campaigns, victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.¹ The Record reports the researchers saw particular interest in agencies responsible for foreign affairs, economic development, agriculture and environmental management.²

Talos observed activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026 and a Belarusian government entity ahead of a bilateral meeting in April.¹ The Record notes the researchers said the timing may indicate an interest in diplomatic developments but does not establish what information the hackers sought or whether they obtained it.²

For activity observed from June 2025 through August 2026, Talos identified four infection-chain types using macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell and a crafted WinRAR archive exploiting CVE-2025-8088, with payloads including several custom reverse shells.¹ According to The Record, the group typically uses phishing emails with official-looking attachments, sometimes sent from legitimate government accounts that were already compromised, and uses GitHub to store malicious scripts.² Talos says the activity overlaps with Silent Lynx, first reported by Seqrite, and with the YoroTrooper cluster, though it tracks UAT-6275 and YoroTrooper separately because it has not seen direct indicator or toolset overlap.¹

Why it matters: the Kazakhstan attribution is a medium-confidence assessment by Talos, but the researchers' findings on the group's exposed tooling and its first observed use of a software exploit (CVE-2025-8088) give defenders in regional government bodies concrete material to hunt for. Talos says the recovered files suggest preparation for activity against Linux hosts and internet-facing appliances, which would take the group beyond phishing lures aimed at Windows users.¹²