Loading threat actor…
TAG-193, also tracked as UAT-6275 and Silent Lynx, is a cyber-espionage threat actor targeting government organizations across Central Asia and the wider Commonwealth of Independent States. Its targeting encompasses institutions responsible for diplomacy, economic development, agriculture, environmental policy, water resources, and forestry. Observed activity has involved government entities in Tajikistan, Belarus, and Armenia, infrastructure associated with Uzbekistan’s Smart Forestry initiative, and targets in Russia. Its country of origin and state sponsorship are not established. TAG-193 frequently conducts spearphishing using compromised government email accounts and official-looking documents to lend credibility to its messages. Its lures include diplomatic correspondence, aviation application forms, and business proposals. The group maintains an evolving malware toolkit and delivery techniques supporting sustained espionage operations. Organizations referenced in its lure documents are not necessarily confirmed victims.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
307 indicators attributed to this actor. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.