Secure CIS Government Systems Against UAT-6275 Intrusions
Researchers link a Kazakhstan-nexus threat group to attacks on government agencies across the Commonwealth of Independent States using exposed code.
Key points
- Cisco Talos and Recorded Future identified UAT-6275 targeting CIS government organizations.
- The group used macro-enabled documents and a WinRAR flaw to install custom reverse shells.
- Publicly accessible directories and GitHub history exposed the malware's development process.
Cisco Talos and Recorded Future researchers discovered that a threat group known as UAT-6275 targeted government organizations across the Commonwealth of Independent States. The attackers focused on agencies handling diplomacy, economic development, and environmental management. This activity suggests an interest in regional diplomatic developments and resource information.
In plain English
The attackers used several methods to get into these systems. They sent macro-enabled documents and used downloaders that hide malicious code. They also exploited a vulnerability in WinRAR software to run harmful scripts. Once inside, they installed reverse shells that allow remote control of the compromised computers.
The background
Cisco Talos assesses with medium confidence that UAT-6275 has a nexus in Kazakhstan. This conclusion is based on infrastructure access, language artifacts, and working hours analysis. The group overlaps with Silent Lynx and YoroTrooper campaigns. Victims span nine countries including Kazakhstan, Russia, and Belarus.
What changes now
The attackers left three staging directories and a GitHub repository publicly accessible. These exposed assets revealed payload builds and command-and-control infrastructure changes. The files suggest preparation for post-compromise operations on Linux hosts. Researchers recovered artifacts showing interest in water resources and energy sectors.
Key terms explained
Reverse shells allow attackers to control a computer remotely by connecting back to their server. Macro-enabled documents contain scripts that run when opened, often bypassing basic security. Command-and-control infrastructure lets hackers send instructions to infected devices. Teams usually monitor for unusual outbound connections and verify document integrity before opening files.
What to do and how to stay safe: UAT-6275
- Review logs for connections to known malicious infrastructure or unusual PowerShell activity.
- Ensure WinRAR software is updated to patch CVE-2025-8088 if you use it.
- Monitor for macro-enabled documents from unexpected sources in government environments.
- Check GitHub repositories for exposed code that could reveal internal tools or credentials.
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which countries are targeted by UAT-6275?
The group targets organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
What vulnerability did the attackers use?
They exploited CVE-2025-8088 in WinRAR to run malicious scripts and gain access.
Is there a patch for this threat?
No specific fix for the UAT-6275 malware has been confirmed, but updating WinRAR addresses the exploited vulnerability.
