Threat reportAPTTL-2026-3512
Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257)
Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets (TL-2026-3512), also tracked as UAT-6275, is a high-severity advanced persistent threat campaign, first published 2026-10-14 and last reviewed 2026-10-15. It is attributed to UAT-6275 (Kazakhstan) with medium confidence, affects RARLAB WinRAR (Windows), references 2 CVEs (CVE-2025-8088, CVE-2025-25257), maps to 17 MITRE ATT&CK techniques (T1027, T1036, T1053.005), and is covered by 9 detection rules and 44 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 1UAT-6275
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 44Indicators of compromise
Key facts for TL-2026-3512
- Threat ID
- TL-2026-3512
- Also known as
- UAT-6275, Silent Lynx, TAG-193
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- UAT-6275
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Kazakhstan
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomacy, economic development, agriculture, environmental management, water resources, energy
- Target regions
- kazakhstan, kyrgyzstan, tajikistan, turkmenistan, uzbekistan, armenia, azerbaijan, russia, belarus
- Detection rules
- 9
- Indicators of compromise
- 44
- Updates
- 2026-10-15 · revalidated 1× · latest source
Malware and tooling in Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
Malware and tooling: Chvost, Laplas (Reverseshell), PickleShell, Ps2exe, Tomiris - S0671, PS2EXE, fscan, ligolo-mp
How Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets works
Cisco Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus and has run espionage campaigns since June 2025 against government organizations in nine CIS countries. Exposed infrastructure revealed four malware delivery chains, custom reverse shells (Chvost, Laplas, PickleShell) and a FortiWeb CVE-2025-25257 PoC.
UAT-6275, tracked by other vendors as Silent Lynx and TAG-193 (Recorded Future) and overlapping with the broader YoroTrooper cluster, targets government organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Targeted functions include diplomacy, economic development, agriculture, environmental management, water resources and energy. Talos identified at least eight campaigns between June 2025 and May 2026 (the hunt skeleton cites activity into August 2026), including Tajik government activity in March 2026 after treaty discussions.
Talos describes four delivery chains. Chain A (June 2025) used macro-enabled Word documents to download and execute a second-stage binary. Chain B (July 2025) used PS2EXE-compiled PowerShell downloaders that retrieved reverse-shell payloads and created scheduled tasks for persistence. Chain C (October 2025) used a malicious shortcut (LNK) that launched PowerShell to retrieve and execute a GitHub-hosted script; later variants placed PickleShell in the Windows Startup folder. Chain D (April 2026) used a RAR archive exploiting WinRAR path traversal CVE-2025-8088 to drop PickleShell into the Startup folder.
Post-compromise tooling is built around lightweight custom reverse shells: Chvost, Laplas and PickleShell. The group maintained a previously unreported GitHub repository hosting PowerShell scripts and payloads; commit history showed infrastructure changes and malware development consistent with UTC+5 working hours. A proof-of-concept exploit for Fortinet FortiWeb SQL injection CVE-2025-25257 was recovered from UAT-6275 infrastructure, and the exposed infrastructure also held Linux-compatible tooling. Talos' published IOC list shows extensive dynamic-DNS domains impersonating Microsoft, Red Hat, CentOS, Debian and Ubuntu update services, plus open-directory hosts serving fscan, ligolo-mp and ELF payloads.
Attribution: medium-confidence Kazakhstan nexus based on Russian-language artifacts, malware submissions from Kazakhstan shortly after compilation, and UTC+5 operator activity. Talos notes overlaps with Silent Lynx, TAG-193 and YoroTrooper, and related clusters Tomiris, ShadowSilk, Cavalry Werewolf and Hydra Saiga. No CVSS score applies to the campaign itself.
MITRE ATT&CK techniques used in TL-2026-3512
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.005 Visual Basic; T1203 Exploitation for Client Execution; T1204.002 Malicious File
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution
Initial Access
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1587.001 Malware; T1588.005 Exploits; T1608.001 Upload Malware
Affected products and versions in Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
Remediation for Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
Patches
- Upgrade WinRAR to 7.13 or later (CVE-2025-8088)
- Upgrade FortiWeb to 7.0.11, 7.2.11, 7.4.8 or 7.6.4 or later (CVE-2025-25257)
Immediate actions
- Block and hunt the Talos-published IPs, dynamic-DNS domains and GitHub raw URLs (Cisco-Talos/IOCs 2026/10 uat-6275-silent-lynx)
- Hunt for PickleShell, Chvost and Laplas artifacts in Startup folders and scheduled tasks
- Audit outbound access to raw.githubusercontent.com from non-developer hosts for PowerShell download cradles
Workarounds
- Remove or restrict WinRAR where it cannot be patched
- Deploy Talos ClamAV and Snort signatures for PickleShell, Chvost and Laplas
Longer-term hardening
- Disable Office macros from internet-sourced documents and block LNK and archive-delivered executables at the mail gateway
- Restrict PowerShell with Constrained Language Mode and enable Script Block Logging
- Alert on dynamic-DNS domains impersonating software update services
CVEs associated with Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
Weaknesses (CWE) in Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
Timeline of Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
- Earliest UAT-6275 activity (month-level): Chain A uses macro-enabled Word documents to download and execute a second-stage binary.
- Chain B (month-level): PS2EXE-compiled downloaders retrieve reverse-shell payloads and create scheduled tasks for persistence.
- Fortinet FortiWeb SQL injection CVE-2025-25257 published (CVSS 9.8); added to CISA KEV on 2025-07-18. A PoC later surfaced on UAT-6275 infrastructure.
- WinRAR path traversal CVE-2025-8088 published (CVSS 8.8, fixed in 7.13); added to CISA KEV on 2025-08-12.
- Chain C (month-level): malicious shortcut launches PowerShell to fetch a GitHub-hosted script; later variants drop PickleShell into the Startup folder.
- Activity against Tajik government organizations (month-level) following treaty discussions.
- Chain D (month-level): RAR archive exploiting CVE-2025-8088 places PickleShell in the Windows Startup folder.
- Cisco Talos publishes UAT-6275 research with a Kazakhstan-nexus assessment (medium confidence) and IOCs in the Cisco-Talos/IOCs repository.
Update history for TL-2026-3512
- 2026-10-15 — UAT-6275 (TAG-193 / Silent Lynx) Uses WinRAR CVE-2025-8088 Exploit and GitHub-Hosted PowerShell to Target CIS Governments: What changed No severity, exploitability or status change; the existing HIGH / ACTIVE values already match the newer report. Enrichment only. New indicators (13) 13 new indicators: 6 dynamic-DNS domains (Microsoft, Red Hat and CentOS impers
Sources cited for Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
- Cisco Talos IOCs - UAT-6275 / Silent Lynx (2026/10)
- NVD - CVE-2025-8088 (WinRAR path traversal)
- NVD - CVE-2025-25257 (Fortinet FortiWeb SQL injection)
- CISA Known Exploited Vulnerabilities Catalog (CVE-2025-8088 added 2025-08-12; CVE-2025-25257 added 2025-07-18)
- Silent Lynx using PowerShell, Golang, and C++ loaders in multi-stage cyberattacks (The Hacker News)
- Silent Lynx: uncovering a cyber espionage campaign in Central Asia (Virus Bulletin 2025 slides)
- Hydra Saiga: covert espionage and infiltration of critical utilities (VMRay)
Detection coverage for TL-2026-3512
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3512 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3512
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.