TAG-193 Targets Central Asian and CIS Governments With Espionage Malware

Cisco Talos and Recorded Future investigated UAT-6275, also tracked as TAG-193, targeting government organizations across Central Asia and the Commonwealth of Independent States from June 2025 through August 2026. Observed activity involved government entities around diplomatic developments concerning Kazakhstan, environmental and resource-management institutions in Armenia and Uzbekistan, and targeting involving Nizhny Novgorod, Russia. Earlier reporting identified targeting of Central Asian water-resource organizations. Talos assesses a Kazakhstan nexus with medium confidence and considers UAT-6275 likely part of the broader YoroTrooper activity cluster, but tracks them separately because no direct indicator or toolset overlap has been observed. Diplomatic timing and lure content suggest possible intelligence interests but do not establish collection objectives or successful compromises of named organizations.

TAG-193 frequently sends spearphishing messages from compromised government accounts, using official-looking diplomatic, aviation, and business documents. Investigators identified four delivery chains: macro-enabled documents, PS2EXE downloaders, malicious shortcuts retrieving GitHub-hosted PowerShell, and a WinRAR archive exploiting CVE-2025-8088. Three publicly accessible staging directories and a GitHub repository exposed custom reverse shells, infrastructure changes, and tooling suggesting possible expansion toward Linux systems and internet-facing appliances. Defenders should prioritize WinRAR patching, restrict unnecessary Office macros and scripting, and investigate unusual government-account messages alongside shortcut-triggered PowerShell downloads and reverse-shell activity.