SECURITY researchers have publicised an active espionage campaign attributed to the UAT-6275 group (also tracked as TAG-193) targeting CIS governments and allied institutions. The campaigns ran from June 2025 to August 2026, culminating in four distinct infection chains. Early methods relied on macro-enabled Word documents dropping second-stage binaries, then standalone PS2EXE-built executables, and later malicious shortcuts invoking PowerShell scripts hosted on GitHub.
Investigators exposed the group’s operational security weaknesses via three open staging directories and a public GitHub repo containing their scripts, which provided direct visibility into recent activity.
In April 2026 the threat actors deployed their first software vulnerability exploit, crafting a malicious RAR archive that exploited WinRAR CVE-2025-8088 to implant a reverse shell named PickleShell into Windows Startup. The group also used custom reverse shells such as Chvost, Laplas and PickleShell for persistence, and leveraged Linux tools with a proof-of-concept for FortiWeb CVE-2025-25257 on exposed servers.
Cisco Talos and Recorded Future Insikt Study note a Kazakhstan nexus for UAT-6275, with 95% of their 77 GitHub commits occurring between 09:00 and 18:00 in UTC+5 Astana time. By early 2025, at least eight campaigns affected nine countries including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus, with a focus on diplomatic, economic, agricultural and environmental ministries and regional energy and water security.
Defenders are advised to patch CVE-2025-8088 and monitor unusual PowerShell activity or GitHub payloads, while auditing scheduled tasks and Windows Startup folders to detect persistent reverse shells.