Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Summary: Cisco Talos and Recorded Future's Insikt Group jointly investigated UAT-6275, a group targeting government organizations across the CIS, and uncovered three publicly accessible staging directories and a previously unreported GitHub repository hosting malicious scripts and payloads. Since Seqrite first reported Silent Lynx in January 2025, the researchers identified at least eight campaigns through May 2026 spanning nine countries, using infection chains A through D that progressed from macro-enabled Word documents to a WinRAR exploit for CVE-2025-8088 observed in April 2026.
Why it matters: Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, citing Russian-language artifacts, malware-testing submissions from Kazakhstan shortly after compilation, and operator activity consistent with UTC+5 working hours. The group's lures track regional diplomacy closely enough that activity hit a Tajik government entity shortly after March 2026 treaty discussions with Kazakhstan and a Belarusian entity ahead of an April bilateral meeting.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026