Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

UAT-6275, a threat actor with a likely Kazakhstan nexus, has been targeting government organizations across the Commonwealth of Independent States (CIS) since June 2025. The group uses multiple infection chains involving macro-enabled documents, PS2EXE-packaged downloaders, GitHub-hosted PowerShell scripts, and a WinRAR exploit (CVE-2025-8088) to deploy custom reverse shells such as PickleShell, Chvost, and Laplas. Exposure of staging directories and GitHub repositories revealed infrastructure changes, tooling, and preparations for post-compromise operations, including potential targeting of Linux systems. The actor shows interest in diplomatic, energy, and water resource sectors, with activity aligned to regional geopolitical developments.

AI-extracted · verify before operational use