Cisco Talos exposes Kazakhstan-linked APT group UAT-6275 targeting CIS governments
Cisco Talos, working with Recorded Future's Insikt Group, uncovered activity by a threat actor tracked as UAT-6275 (also known as TAG-193 or Silent Lynx) targeting government, diplomatic, environmental and energy organizations across Kazakhstan, Central Asia and the wider CIS region since June 2025. The group used four distinct infection chains — malicious macro documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and a WinRAR archive exploiting CVE-2025-8088 — to deploy custom reverse shells such as Chvost, Laplas and PickleShell. Exposed staging servers and a GitHub repository gave researchers visibility into the group's tooling, including a FortiWeb exploit (CVE-2025-25257) and Linux-capable tools, suggesting plans to expand beyond Windows targets. Talos assesses with medium confidence that the group has a Kazakhstan nexus based on language artifacts, submission patterns and working-hour analysis.