# Kazakhstan-nexus UAT-6275 (TAG-193 / Silent Lynx) targets CIS government organizations with Chvost, Laplas and PickleShell (CVE-2025-8088, CVE-2025-25257)

> Cisco Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus and has run espionage campaigns since June 2025 against government organizations in nine CIS countries. Exposed infrastructure revealed four malware delivery chains, custom reverse shells (Chvost, Laplas, PickleShell) and a FortiWeb CVE-2025-25257 PoC.

- **Published:** 2026-10-14T14:27:40Z
- **Last reviewed:** 2026-10-15T09:16:47.736Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3512
- **ID:** TL-2026-3512
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UAT-6275 (Kazakhstan)
- **Detections:** 9 · **IOCs:** 64 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088, CVE-2025-25257

## Description

UAT-6275, tracked by other vendors as Silent Lynx and TAG-193 (Recorded Future) and overlapping with the broader YoroTrooper cluster, targets government organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Targeted functions include diplomacy, economic development, agriculture, environmental management, water resources and energy. Talos identified at least eight campaigns between June 2025 and May 2026 (the hunt skeleton cites activity into August 2026), including Tajik government activity in March 2026 after treaty discussions.

Talos describes four delivery chains. Chain A (June 2025) used macro-enabled Word documents to download and execute a second-stage binary. Chain B (July 2025) used PS2EXE-compiled PowerShell downloaders that retrieved reverse-shell payloads and created scheduled tasks for persistence. Chain C (October 2025) used a malicious shortcut (LNK) that launched PowerShell to retrieve and execute a GitHub-hosted script; later variants placed PickleShell in the Windows Startup folder. Chain D (April 2026) used a RAR archive exploiting WinRAR path traversal CVE-2025-8088 to drop PickleShell into the Startup folder.

Post-compromise tooling is built around lightweight custom reverse shells: Chvost, Laplas and PickleShell. The group maintained a previously unreported GitHub repository hosting PowerShell scripts and payloads; commit history showed infrastructure changes and malware development consistent with UTC+5 working hours. A proof-of-concept exploit for Fortinet FortiWeb SQL injection CVE-2025-25257 was recovered from UAT-6275 infrastructure, and the exposed infrastructure also held Linux-compatible tooling. Talos' published IOC list shows extensive dynamic-DNS domains impersonating Microsoft, Red Hat, CentOS, Debian and Ubuntu update services, plus open-directory hosts serving fscan, ligolo-mp and ELF payloads.

Attribution: medium-confidence Kazakhstan nexus based on Russian-language artifacts, malware submissions from Kazakhstan shortly after compilation, and UTC+5 operator activity. Talos notes overlaps with Silent Lynx, TAG-193 and YoroTrooper, and related clusters Tomiris, ShadowSilk, Cavalry Werewolf and Hydra Saiga. No CVSS score applies to the campaign itself.

## MITRE ATT&CK

- T1566 Phishing
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1568 Dynamic Resolution
- T1583.001 Domains
- T1583.006 Web Services
- T1587.001 Malware
- T1588.005 Exploits
- T1608.001 Upload Malware
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1586.002 Compromise Accounts
- T1566.001 Phishing
- T1564.004 Hide Artifacts
- T1564.003 Hide Artifacts
- T1036.004 Masquerading
- T1071.001 Application Layer Protocol
- T1573 Encrypted Channel

## Sources

- [Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations](https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/)
- [Cisco Talos IOCs - UAT-6275 / Silent Lynx (2026/10)](https://github.com/Cisco-Talos/IOCs/tree/main/2026/10)
- [NVD - CVE-2025-8088 (WinRAR path traversal)](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [NVD - CVE-2025-25257 (Fortinet FortiWeb SQL injection)](https://nvd.nist.gov/vuln/detail/CVE-2025-25257)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2025-8088 added 2025-08-12; CVE-2025-25257 added 2025-07-18)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Silent Lynx using PowerShell, Golang, and C++ loaders in multi-stage cyberattacks (The Hacker News)](https://thehackernews.com/2025/02/silent-lynx-using-powershell-golang-and.html)
- [Silent Lynx: uncovering a cyber espionage campaign in Central Asia (Virus Bulletin 2025 slides)](https://www.virusbulletin.com/uploads/pdf/conference/vb2025/slides/Slides-Silent-Lynx-uncovering-a-cyber-espionage-campaign-in-Central-Asia.pdf)
- [Hydra Saiga: covert espionage and infiltration of critical utilities (VMRay)](https://www.vmray.com/hydra-saiga-covert-espionage-and-infiltration-of-critical-utilities/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3512