UAT-6275 Hackers Use WinRAR Exploit and GitHub PowerShell to Target CIS Governments

An espionage campaign targeting government organizations across the Commonwealth of Independent States (CIS), with additional interest in water, environmental, and energy sectors.

The investigation found four infection chains active from June 2025 through 2026.

The attackers used macro-enabled Word documents, PS2EXE-built executables, malicious shortcuts that launched GitHub-hosted PowerShell, and a crafted WinRAR archive that exploited CVE-2025-8088.

The chains delivered lightweight reverse shells that gave operators interactive access to compromised Windows systems.

The earliest observed chain, in June 2025, used a Word document with a VBA macro to download and launch a second-stage payload.

In July, Talos identified PS2EXE-generated downloaders PowerShell scripts packaged as executable files that retrieved malware and established persistence with scheduled tasks.

A third chain, first observed in October 2025, used a malicious Windows shortcut to launch PowerShell, retrieve a script from GitHub and run it.

Later versions also downloaded PickleShell, a custom reverse shell, and placed it in the Windows Startup folder.

The most significant change appeared in April 2026. A malicious RAR archive exploited CVE-2025-8088, a WinRAR path-traversal vulnerability, to write PickleShell into the user’s Startup folder.

The payload then launched at the next sign-in, establishing persistence without requiring elevated privileges.

The researchers described this as the first vulnerability exploit they had observed in UAT-6275’s malware-delivery chain.

Talos tracks the activity as UAT-6275, while Recorded Future uses the designation TAG-193. Researchers say the campaign’s regional focus may reflect intelligence priorities shaped by the effects of the Russia–Ukraine war.

Three publicly accessible staging directories and a previously unreported GitHub repository exposed scripts, payloads, tool inventories and changes to command-and-control (C2) infrastructure.

UAT-6275 Cyberattack Campaign

The repository’s history gave investigators a view of the group’s development activity and infrastructure updates.

UAT-6275’s tools include custom reverse shells named Chvost, Laplas and PickleShell, built for interactive command execution.

Recovered materials also point to preparation beyond Windows intrusions. Researchers found Linux-compatible tools and a public proof-of-concept exploit for Fortinet FortiWeb vulnerability CVE-2025-25257 on the group’s infrastructure.

These discoveries indicate potential interest in Linux hosts and internet-facing appliances; they do not, on their own, confirm that the group exploited FortiWeb systems in the wild.

The observed campaigns and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.

Decoys referenced diplomatic affairs, trade, forestry, environmental management and energy including a proposal framed as cooperation between Turkmennebit and Russia’s Orsk Oil Refinery.

The sector and document themes are consistent with intelligence collection, though they do not establish the precise information sought in each intrusion.

Talos assesses with medium confidence that the group has a Kazakhstan nexus, citing infrastructure access, Russian-language artifacts, sample submissions and activity times consistent with UTC+5 working hours.

The researchers also assess that UAT-6275 and YoroTrooper may belong to a broader activity cluster, but continue to track them separately because they have not observed direct overlap in indicators or toolsets.

The activity overlaps with Silent Lynx, first reported by Seqrite in January 2025, and with campaigns discussed by other researchers under names including Tomiris, ShadowSilk, Cavalry Werewolf and Hydra Saiga.

These labels reflect reporting by different security vendors; overlap does not necessarily mean the groups are identical.

The combination of socially engineered archives, trusted services such as GitHub, persistence mechanisms and exploit-assisted delivery gives defenders several points for detection.

Organizations should patch WinRAR against CVE-2025-8088, scrutinize unexpected PowerShell launched by shortcuts or Office processes, and monitor for suspicious Startup-folder changes, scheduled tasks and outbound connections associated with reverse shells.

The full technical analysis and indicators of compromise are available in the Virus Bulletin 2026 paper, “Break the silence: tracking Silent Lynx through exposed infrastructure.”

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.