---
title: Hunt: Kazakhstan-nexus UAT-6275 (Silent Lynx / TAG-193) hits CIS governments via PS2EXE, GitHub-hosted PowerShell and WinRAR CVE-2025-8088 | ctxsec
url: https://ctxsec.com/items/hunt-uat-6275-cis
description: ""
status: "hunt idea"
published: 2026-10-14
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-uat-6275-cis.md)

hunt idea

2026-10-14

### Hunt: Kazakhstan-nexus UAT-6275 (Silent Lynx / TAG-193) hits CIS governments via PS2EXE, GitHub-hosted PowerShell and WinRAR CVE-2025-8088

Cisco Talos and Recorded Future Insikt (Oct 14, Virus Bulletin 2026) track UAT-6275 against government, diplomatic, water/environment and energy targets in nine CIS countries (Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus), with activity from June 2025 to August 2026. Talos describes four chains: (A) macro Word docs that pull a second stage; (B) **PS2EXE**-packed downloaders with scheduled-task persistence; (C) LNK files that run PowerShell to fetch a **GitHub-hosted** script, later dropping **PickleShell** into the Startup folder; (D) a crafted RAR exploiting **WinRAR CVE-2025-8088** to plant PickleShell in Startup. Other payloads are the Chvost and Laplas reverse shells. Exposed staging directories also held Linux tooling and a public FortiWeb **CVE-2025-25257** PoC. Talos assesses a Kazakhstan nexus with medium confidence. Hunt for LNK→PowerShell pulling `raw.githubusercontent.com`, PS2EXE-style binaries creating scheduled tasks, new executables in `Startup` after RAR extraction, and WinRAR builds older than 7.13. IOCs, ClamAV and Snort coverage are on Talos' GitHub.

Sources: [Cisco Talos](https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/) · [Talos IOCs (GitHub)](https://github.com/Cisco-Talos/IOCs)