The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Cisco Talos and Recorded Future’s Insikt Group identified espionage activity conducted by threat actor UAT-6275 targeting government and critical infrastructure entities in the Commonwealth of Independent States (CIS). The group uses multiple infection chains, including macro-enabled documents, GitHub-hosted scripts, and exploitation of a WinRAR vulnerability, to deploy custom reverse shells. Operational security lapses by the actor allowed researchers to observe their infrastructure and malware development. The group is evolving its tradecraft, leveraging legitimate platforms like GitHub for payload hosting and showing signs of expanding to Linux and internet-facing appliances.

AI-extracted · verify before operational use