> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations - URL: https://f4n6.co.uk/security-feed/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/ - Published: 2026-10-14T15:15:59.000Z - Updated: 2026-10-14T15:15:59.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2025-25257, CVE-2025-8088, UAT-6275, TAG-193, Silent Lynx, YoroTrooper, Tomiris ## 1\. Executive summary Cisco Talos and Recorded Future's Insikt Group have jointly documented UAT-6275 (tracked by Recorded Future as TAG-193), a suspected Kazakhstan-nexus espionage cluster targeting government organizations across nine CIS states, with activity observed from June 2025 through August 2026\. The group's delivery chain evolved from macro-enabled Word documents to PS2EXE-packaged downloaders, GitHub-hosted PowerShell, and, from April 2026, a crafted RAR archive exploiting CVE-2025-8088 in WinRAR (CVSS 8.4 HIGH, in CISA KEV since 2025-08-12, EPSS 94%). Recovered tooling also includes a proof-of-concept exploit for FortiWeb CVE-2025-25257 (CVSS 9.8 CRITICAL, in CISA KEV since 2025-07-18, EPSS 100%), which indicates preparation to move against internet-facing appliances and Linux hosts. No EMEA financial services victim has been reported, but the group's use of two KEV-listed vulnerabilities and its interest in internet-facing edge devices put any institution running unpatched WinRAR or FortiWeb in scope for the same tooling. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28: ICT third-party risk — general principles | UAT-6275's delivery chain depends on third-party software (WinRAR, FortiWeb) and public code-hosting (GitHub) as a payload channel | Clients must be able to evidence that third-party software risk, including archive utilities and edge appliances, is assessed and patched under the ICT third-party risk framework | | DORA Art. 24: digital operational resilience testing — general requirements | Two KEV-listed CVEs (CVE-2025-8088, CVE-2025-25257) are exploited in this campaign and are testable in a controlled environment | These CVEs are candidate scenarios for the resilience testing programme; detection coverage for archive-exploit delivery and edge-appliance exploitation should be validated | | NIS2 Art. 21(2)(d): supply chain security measures | Malicious PowerShell and payloads were hosted on GitHub, a public service, and delivered via third-party archive software | Supply chain security measures should address public code-hosting as a delivery vector and the patch posture of archive and edge software in the estate | No article is engaged on the basis that "an incident occurred" or "patching is required" in the abstract. The three rows above are tied to facts specific to this campaign: the two KEV-listed CVEs and the use of a public code-hosting service as a payload channel. ## 3\. Technical analysis & attack chain The following chain reflects steps Talos and Recorded Future describe as observed. Where a step rests on a single source or on Talos's own assessment, that is stated. 1. Initial access is via malicious documents, executable downloaders, or shortcuts delivered to government and diplomatic targets. Talos recovered decoy documents themed on diplomatic correspondence, international trade, aviation, and energy cooperation (for example, a letter addressed to Armenia's Ministry of Foreign Affairs, and a Turkmenistan–Russia oil cooperation proposal used in an August 2025 sample). 2. Chain A (first observed June 2025): a macro-enabled Word document downloads and executes a second-stage binary. 3. Chain B (July 2025): a downloader built with PS2EXE, which packages PowerShell scripts as standalone Windows executables, retrieves a reverse-shell payload and creates a scheduled task for persistence. 4. Chain C (first observed October 2025): a malicious shortcut launches PowerShell to retrieve and execute a GitHub-hosted script that provides remote shell access. Later samples download PickleShell and place it in the Windows Startup folder. 5. Chain D (April 2026): a RAR archive exploits CVE-2025-8088 in WinRAR to place PickleShell in the Windows Startup folder. The payload runs at the next user sign-in. Talos describes this as the first vulnerability exploit observed in UAT-6275's malware delivery. 6. Post-compromise access is provided by lightweight reverse shells: Chvost, Laplas, and PickleShell. These give interactive command execution on compromised systems. 7. Recovered Linux-compatible tooling and a publicly available proof-of-concept exploit for FortiWeb CVE-2025-25257 indicate preparation for post-compromise operations and possible activity against Linux hosts and internet-facing appliances. Talos does not report an observed FortiWeb exploitation in this campaign, only the presence of the PoC in the group's infrastructure. CVE-2025-8088 is a path traversal flaw in WinRAR (CWE-35 in the verified data). CVE-2025-25257 is a SQL injection flaw in FortiWeb (CWE-89). The verified reference data records both as exploited and in CISA KEV; the source text does not restate the CWE classifications, so there is no classification discrepancy to note. Infrastructure and operational security: Talos and Recorded Future found three publicly accessible staging directories and a previously unreported GitHub repository used to host malicious scripts and payloads. The repository's commit history exposed payload builds, tool inventories, and changes to C2 infrastructure. This is the primary source of the technical detail in this advisory and is single-sourced to the joint Talos/Recorded Future investigation; the full IOC set is in their Virus Bulletin 2026 white paper and Talos's GitHub repository, neither of which is reproduced here. Attribution: Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on Russian-language artifacts, apparent malware-testing submissions from Kazakhstan shortly after compilation, and operator activity consistent with UTC+5 working hours. Talos states that UAT-6275 overlaps with Silent Lynx (first reported by Seqrite) and sits within a broader set of campaigns connected to YoroTrooper, and that subsequent research on Tomiris, ShadowSilk, Cavalry Werewolf, and Hydra Saiga identified overlapping indicators. Talos assesses that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster but continues to track them separately because no direct indicator or toolset overlap has been observed. None of the named actors (UAT-6275, TAG-193, Silent Lynx, YoroTrooper, Tomiris, ShadowSilk, Cavalry Werewolf, Hydra Saiga) has a MITRE ATT&CK profile in the verified reference data, so all attribution here is unconfirmed and should be treated as vendor assessment, not established fact. ## 4\. Mitigation & containment P1 (within 24 hours) - Patch WinRAR to a version that fixes CVE-2025-8088\. This is the delivery mechanism for Chain D and is in CISA KEV. Where patching cannot be completed immediately, block RAR archive execution from email and web download paths, and alert on WinRAR spawning PowerShell or writing to the Startup folder. - Patch FortiWeb against CVE-2025-25257\. The group holds a PoC exploit for this CVE; no exploitation has been observed in this campaign, but the PoC's presence in their infrastructure is a preparation indicator. Treat internet-facing FortiWeb instances as exposed until patched. - Hunt for the reverse shells named in this campaign (Chvost, Laplas, PickleShell) across endpoints and servers. Check the Windows Startup folder for unexpected executables and check for scheduled tasks created by PS2EXE-packaged binaries. P2 (within 72 hours) - Restrict or monitor outbound PowerShell retrieval from public code-hosting services, specifically GitHub, where it is not required for business operations. Chain C retrieves and executes a GitHub-hosted script; this is the behaviour to detect, not the service to block wholesale. - Audit scheduled tasks and Startup-folder entries for the preceding 90 days for artifacts matching the Chain B and Chain C persistence patterns (PS2EXE-built executables, PowerShell-launched shortcuts). - Review macro execution policy for Office documents received from external senders. Chain A depends on macro-enabled Word documents. P3 (within 7 days) - Add the Talos ClamAV signatures and Snort rules referenced in the source to detection tooling. The source states these exist but does not reproduce them; retrieve them from the Talos blog and GitHub repository. - Review Linux host and edge-appliance exposure for the FortiWeb CVE, including any FortiWeb instances not covered by the P1 patch action. - Where the institution has CIS-region operations or partners, review network flow logs for the targeting pattern Talos describes (activity against government and diplomatic entities timed to bilateral meetings). ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IPs, file paths) are present in the source material provided. The source states that the full IOC set is in the Virus Bulletin 2026 white paper and Talos's GitHub repository, neither of which is reproduced here. The behaviours below are the observable patterns the source describes; they are single-sourced to the joint Talos/Recorded Future investigation and should be verified against the full white paper before enforcement. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------- | | Macro-enabled Word document downloads and executes a second-stage binary | Office process spawning a child process that writes an executable to disk, then executes it | Medium (single source) | | PS2EXE-packaged downloader retrieves a reverse-shell payload and creates a scheduled task | Scheduled task creation by a newly written executable; outbound network connection from that process | Medium (single source) | | Malicious shortcut launches PowerShell to retrieve and execute a GitHub-hosted script | PowerShell command line containing a GitHub URL; script execution from a shortcut target | Medium (single source) | | PickleShell placed in the Windows Startup folder | File creation in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup or the equivalent system path | Medium (single source) | | Crafted RAR archive exploits CVE-2025-8088 to write PickleShell to the Startup folder | WinRAR process writing to the Startup folder; archive extraction followed by execution at next sign-in | Medium (single source) | | Reverse-shell command execution via Chvost, Laplas, or PickleShell | Interactive command execution from a process with no legitimate parent; outbound connection to C2 | Medium (single source) | ## 6\. Detection The source does not provide distinctive strings, command-line flags, mutex names, or file paths for the reverse shells or downloaders. It does name the tools (Chvost, Laplas, PickleShell, PS2EXE) and the delivery mechanisms (macro-enabled Word, PS2EXE, GitHub-hosted PowerShell, WinRAR CVE-2025-8088). A YARA rule built on tool names would detect reporting about the threat, not the threat, so no YARA rule is emitted. The Sigma rule below targets the behavioural pattern the source describes, which is the usable detection material available. ```yaml title: UAT-6275 Chain C - Shortcut Launches PowerShell to Retrieve GitHub-Hosted Script id: 8f3a2c1e-4b7d-4e9a-9c2f-1a6e5d8b3f70 status: experimental description: Detects a process launched from a shortcut that invokes PowerShell to retrieve and execute a script hosted on GitHub, consistent with UAT-6275 Chain C delivery. author: Adverse Trace date: 2026-10-14 references: - https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/ logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - '\powershell.exe' - '\pwsh.exe' selection_cmd: CommandLine|contains: - 'github.com' - 'githubusercontent.com' selection_flags: CommandLine|contains: - '-enc' - '-EncodedCommand' - '-nop' - '-w hidden' - 'Invoke-Expression' - 'IEX' condition: selection_img and selection_cmd and selection_flags falsepositives: - Legitimate administrative scripts that retrieve tooling from GitHub level: high ``` A second rule for the WinRAR delivery path: ```yaml title: WinRAR Spawns PowerShell or Writes to Startup Folder (CVE-2025-8088 Delivery) id: 2d9b6a4f-7c1e-4a8b-b3d5-6e0f9a2c4d81 status: experimental description: Detects WinRAR spawning PowerShell or writing an executable to the Windows Startup folder, consistent with UAT-6275 Chain D exploitation of CVE-2025-8088. author: Adverse Trace date: 2026-10-14 references: - https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/ logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - '\WinRAR.exe' - '\rar.exe' - '\unrar.exe' selection_child: Image|endswith: - '\powershell.exe' - '\pwsh.exe' - '\cmd.exe' condition: selection_parent and selection_child falsepositives: - Legitimate archive extraction scripts that invoke a shell level: high ``` ## CVE assessment 2 referenced CVEs — **2 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2025-25257](https://nvd.nist.gov/vuln/detail/CVE-2025-25257?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2025-07-18 | 100% | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability \[CWE-89\] vulnerability in… | | [CVE-2025-8088](https://nvd.nist.gov/vuln/detail/CVE-2025-8088?ref=f4n6.co.uk) | 8.4 High | ⚠ KEV 2025-08-12 | 94% | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafti… | ## 7\. Sources - Cisco Talos, "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations", https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/, 2026-10-14 - Cisco Talos and Recorded Future Insikt Group, "Break the silence: tracking Silent Lynx through exposed infrastructure", Virus Bulletin 2026 white paper (referenced in the source, not fetched) - Recorded Future Insikt Group, related blog post (referenced in the source, not fetched) - Cisco Talos GitHub repository, IOC set (referenced in the source, not fetched) ## 8\. Adverse Trace position Adverse Trace assesses this as a regional espionage campaign with no observed EMEA financial services victim, but with two KEV-listed vulnerabilities in its tooling and a demonstrated interest in internet-facing appliances and Linux hosts. The immediate risk to clients is not the campaign's current targeting but the exposure of unpatched WinRAR and FortiWeb instances to the same tooling, both of which are in CISA KEV and have EPSS scores of 94% and 100% respectively. The attribution to a Kazakhstan nexus is Talos's medium-confidence assessment and is unconfirmed; none of the named actors has a MITRE ATT&CK profile in our reference data, so we treat the cluster names as vendor labels rather than established actor identities. The IOC set is single-sourced to the joint Talos/Recorded Future investigation and is not reproduced in this advisory; clients should retrieve the full white paper and Talos GitHub repository before enforcing any indicator-based detection. We will monitor for EMEA-region targeting, for exploitation of CVE-2025-8088 or CVE-2025-25257 in financial services, and for publication of the full IOC set, and will issue a follow-up if either CVE is observed in a client environment. --- [Read the original source →](https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*