New Research Maps UAT-6275 Espionage Against CIS Government Organizations

Joint research published by Cisco Talos and Recorded Future on October 14, 2026 provides new visibility into UAT-6275, also tracked as TAG-193 or Silent Lynx. Exposed staging infrastructure and repository history helped researchers connect government-targeted campaigns and trace changes in the group's tooling. ## Affected systems The reports concern government and diplomatic organizations across Central Asia and the wider Commonwealth of Independent States, including institutions involved in economic development, agriculture and environmental management. Windows workstations exposed to malicious documents, downloads or archive files are the documented delivery targets. A named institution appearing in a decoy is not, by itself, a confirmed victim. ## Access path Recorded Future describes spearphishing from compromised government email accounts and malicious content hosted on familiar public services. Talos identified four delivery-chain types, including documents, executable downloaders and an archive exploiting WinRAR CVE-2025-8088. This is observed use of a known vulnerability, not a newly discovered WinRAR zero-day. ## Impact Recovered reverse-shell payloads enable interactive remote access to compromised systems. The targeting is consistent with intelligence collection, but the reports do not quantify stolen data or establish physical disruption of water, forestry or energy operations. Recovered Linux tooling and a FortiWeb exploit indicate capability interest; the researchers did not confirm that FortiWeb flaw was exploited in the wild by this group. ## Mitigations Keep archive utilities patched and use the researchers' linked indicators in defensive review. Protect email accounts and investigate unexpected script execution, public-service payload downloads and persistence changes on workstations. Familiar sender accounts or hosting domains are not sufficient grounds to trust a file. ## Uncertainty The October disclosure describes activity observed during 2025–2026; it does not imply the campaign began today. Talos assesses a Kazakhstan nexus with medium confidence. Recorded Future says organizational affiliation and state sponsorship remain unresolved. Timing near diplomatic events supplies context, not proof of the operators' specific collection objectives.