KazakhstanAssessedKazakhstan nexusEspionageActive 2025 – 2026Silent Lynx
Also known asUAT-6275 · TAG-193
Summary
Espionage cluster against government bodies across Central Asia and the wider CIS, tracked by Cisco Talos as UAT-6275 and by Recorded Future as TAG-193, and overlapping Silent Lynx (first reported by Seqrite in January 2025). Talos assesses with medium confidence that it has a Kazakhstan nexus; Recorded Future says questions about its origins remain. Victims and lures span Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus, with interest in diplomacy, economic development, agriculture, water and energy — including a Tajik government body after treaty talks with Kazakhstan (March 2026) and a Belarusian one before a bilateral meeting (April 2026). From June 2025 to August 2026 it used macro-enabled Word documents (T1204.002), PS2EXE downloaders with scheduled tasks (T1053.005), shortcuts fetching GitHub-hosted PowerShell (T1059.001, T1102) and, from April 2026, WinRAR CVE-2025-8088 dropping PickleShell into the Startup folder (T1547.001). Payloads are lightweight reverse shells — Chvost, Laplas, PickleShell. Talos sees it within the broader YoroTrooper activity set but tracks it separately.
Attribution
Talos: medium confidence; Recorded Future: origins still open; no government attribution
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Cisco Talos (Research, 2026-10-14)
Kazakhstan nexus, medium confidence - Recorded Future Insikt Group (Research, 2026-10-14)
Possible links to Kazakhstan; origins still open
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Tajik and Belarusian government entities around bilateral talks | 2026-03 – 2026-04 | Tajikistan, Belarus | Government, Diplomatic | Cisco Talos (2026-10-14) — network-flow analysis |
| CIS government espionage — four infection chains, Chvost / Laplas / PickleShell | 2025-06 – 2026-08 | Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, Belarus | Government, Diplomatic, Energy, Agriculture | Cisco Talos with Recorded Future (2026-10-14) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Execution3 | T1204.002Malicious FileT1053.005Scheduled TaskT1059.001PowerShell |
|---|---|
| Persistence1 | T1547.001Registry Run Keys / Startup Folder |
| Command and Control1 | T1102Web Service |
Malware and tools 3
| Name | Description | Platform |
|---|---|---|
| Chvost | Reverse shell | Windows |
| Laplas | Reverse shell | Windows |
| PickleShell | Reverse shell | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-8088 | 8.4 | RARLAB WinRAR — path traversal via alternate data streams (KEV 2025-08-12) |
Highest CVSS first.
Infrastructure patterns
- GitHub repository hosting its PowerShell scripts and payloads (Cisco Talos, 2026)
- Publicly exposed staging directories holding builds and tooling (Cisco Talos, 2026)
Reporting and advisories 2
- Cisco Talos
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (Oct 2026) - Recorded Future Insikt Group
TAG-193's Regional Espionage Operations (Oct 2026)