UAT-6275

UAT-6275, also tracked as TAG-193, is a cyberespionage threat actor active since at least January 2025 that targets government institutions across Central Asia and the Commonwealth of Independent States. Its targeting encompasses diplomacy, economic development, agriculture, environmental management, water resources, and energy. Campaigns have involved Russia, Belarus, Armenia, Azerbaijan, Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, and Uzbekistan. Government sponsorship has not been established. The group primarily delivers malware through phishing emails containing diplomatic correspondence, business proposals, and other official-looking lures, sometimes sent from compromised government email accounts. Delivery methods include macro-enabled Microsoft Word documents, PS2EXE-packaged PowerShell downloaders, and malicious shortcuts that retrieve scripts and payloads hosted on GitHub. It also operates credential-harvesting infrastructure impersonating government services. Beginning in April 2026, UAT-6275 exploited the WinRAR path traversal vulnerability CVE-2025-8088 through crafted archives containing decoy documents and hidden payload records abusing NTFS alternate data streams. This technique places malware in the current user's Startup folder without administrator privileges, enabling execution at the next sign-in. Other infection chains establish persistence through scheduled tasks. Its custom reverse shells include PickleShell, Chvost, and Laplas, which provide interactive remote command execution. PickleShell is a C#/.NET implant that masquerades as a Windows service component and launches a hidden command shell; later versions use encrypted communications. UAT-6275 activity overlaps with Silent Lynx phishing campaigns. It is tracked separately from YoroTrooper, with no direct indicator or toolset overlap established between the two.