Cisco Talos and Recorded Future Insikt (Oct 14, Virus Bulletin 2026) track UAT-6275 against government, diplomatic, water/environment and energy targets in nine CIS countries (Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus), with activity from June 2025 to August 2026. Talos describes four chains: (A) macro Word docs that pull a second stage; (B) PS2EXE-packed downloaders with scheduled-task persistence; (C) LNK files that run PowerShell to fetch a GitHub-hosted script, later dropping PickleShell into the Startup folder; (D) a crafted RAR exploiting WinRAR CVE-2025-8088 to plant PickleShell in Startup. Other payloads are the Chvost and Laplas reverse shells. Exposed staging directories also held Linux tooling and a public FortiWeb CVE-2025-25257 PoC. Talos assesses a Kazakhstan nexus with medium confidence. Hunt for LNK→PowerShell pulling raw.githubusercontent.com, PS2EXE-style binaries creating scheduled tasks, new executables in Startup after RAR extraction, and WinRAR builds older than 7.13. IOCs, ClamAV and Snort coverage are on Talos' GitHub.