A cyber-espionage crew that researchers link to Kazakhstan has spent more than a year breaking into government bodies across Central Asia and the wider Commonwealth of Independent States (CIS), with a striking interest in who controls the region's water, forests and fuel. Joint research from Cisco Talos and Recorded Future's Insikt Group shows the group's own sloppy housekeeping handed investigators a view of its toolkit, its GitHub account and even its working hours.
Talos tracks the cluster as UAT-6275 and Recorded Future as TAG-193. It overlaps with Silent Lynx, first reported by Seqrite in January 2025, and sits within the broader set of campaigns tied to YoroTrooper. Talos says the two likely belong to the same wider activity cluster but still tracks them separately because it has not seen direct indicator or tooling overlap. The research was written up by Ashley Shen of Talos together with Julian-Ferdinand Vögele of Insikt Group.
Ministries, treaties and the region's rivers
Observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. The targets are government institutions that handle diplomacy, economic development, agriculture and environmental management. Network flow analysis caught activity involving a Tajik government entity shortly after treaty talks with Kazakhstan in March 2026, and a Belarusian agriculture-related government entity ahead of a bilateral meeting in Astana in April. Recorded Future cautions that this timing does not prove the intrusions were connected to those events.
The resource angle is what sets the group apart. Talos observed activity involving an Armenian government environmental body and infrastructure tied to Uzbekistan's Smart Forestry initiative, consistent with earlier reporting on Silent Lynx hitting water-resource organizations. One energy-themed decoy proposed cooperation between Turkmenistan's state oil company Turkmennebit and Russia's Orsk Oil Refinery, which supplies petroleum products to Kazakhstan.
Trusted inboxes, GitHub and a WinRAR exploit
The group often sends spearphishing from compromised government email accounts, attaching official-looking documents such as a diplomatic letter to Armenia's Ministry of Foreign Affairs and a Turkmenistan airspace application form. Talos sorted the recovered samples into four infection chains first seen between June 2025 and April 2026: macro-enabled Word documents, downloaders built with PS2EXE (a tool that wraps PowerShell scripts as Windows executables), malicious shortcuts that pull a PowerShell script from GitHub, and, from April 2026, a crafted RAR archive exploiting CVE-2025-8088 in WinRAR to drop the PickleShell backdoor into the Windows Startup folder so it runs at the next sign-in. Recorded Future says that chain was likely used against Armenia's foreign ministry, and Talos calls it the first exploit it has seen in the group's delivery. The same WinRAR bug has been a favourite of Russia-aligned crews targeting Ukraine.
The payloads are lightweight reverse shells that give operators interactive command access, including Chvost, Laplas and PickleShell. Investigators also found Linux-compatible tooling and a public proof-of-concept exploit for FortiWeb CVE-2025-25257 on the group's servers, though Recorded Future says the research did not confirm the FortiWeb flaw was exploited in the wild.
Exposed servers gave the game away
Three publicly accessible staging directories and a previously unreported GitHub repository exposed payload builds, tool inventories and command-and-control changes. Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, citing Russian-language artifacts, apparent malware-testing submissions from Kazakhstan shortly after compilation, and the timing of 77 GitHub commits that fits UTC+5 office hours. Both firms stress that this does not establish the group's organizational affiliation or any state sponsorship.
Patch WinRAR and watch PowerShell pulling from GitHub
Talos advises defenders in government, environmental, economic and energy bodies across the region to monitor for unexpected PowerShell activity, payload downloads from public services such as GitHub, new scheduled tasks and Startup-folder changes, and to keep archive utilities patched. Talos has published ClamAV signatures and Snort rules, and the full indicator set sits in its GitHub repository and the joint Virus Bulletin 2026 paper.
Whoever is ultimately behind it, the targeting shows patient interest less in headline victims than in the quiet paperwork of rivers, forests and fuel deals, and in the officials who negotiate them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.