Kazakhstan-linked UAT-6275 (TAG-193) spies on Central Asian governments
The Record reports that a cyber-espionage group suspected of ties to Kazakhstan has targeted government agencies across Central Asia and other former Soviet states. The Record’s report, Suspected Kazakhstan-linked hackers target governments across former Soviet states, draws on joint research from Cisco Talos, which tracks the group as UAT-6275, and Recorded Future’s Insikt Group, which calls it TAG-193. No CVE or patch deadline is tied to this campaign in the report, but the group has used a WinRAR vulnerability, so defenders should check their WinRAR patch level.
What we know
According to The Record, the two research teams said the group has run at least eight campaigns since January 2025. Targets, or organisations the group showed interest in, sit in nine countries, including Russia, Belarus, Armenia, Uzbekistan and Tajikistan.
- Researchers said the group is interested in agencies covering foreign affairs, economic development, agriculture and environmental management, plus information on regional energy supplies and water resources.
- The researchers assessed with medium confidence that the group has ties to Kazakhstan. The clues are Russian-language material in the malware, signs that malware was tested from Kazakhstan shortly after it was created, and activity that generally matched working hours in the country’s time zone.
- Its operations overlap with earlier campaigns linked to YoroTrooper, a suspected Kazakhstan-based actor that emerged in 2022.
- One attack hit a Tajik government entity shortly after treaty talks with Kazakhstan in March 2026. Another hit a Belarusian government entity ahead of a bilateral meeting in April.
- In April 2026 the group was observed exploiting a vulnerability in WinRAR in an operation likely aimed at an Armenian foreign ministry, according to the report. The CVE ID is not disclosed in the material we reviewed.
How the attacks work
The group typically gets in through phishing emails with malicious attachments. Some were sent from legitimate government email accounts that had already been compromised, which makes them harder to spot. The lures look like official documents: diplomatic correspondence, aviation forms and business proposals. The group also stored malicious scripts and files on GitHub, which helps its traffic blend in with ordinary developer activity.
Who is affected
Government bodies in the region are the stated focus. The researchers said the timing of some attacks could point to an interest in diplomatic developments, but it does not establish what information the hackers wanted or whether they obtained it. Organisations that work with these ministries, such as contractors, partners and diplomatic missions, could also receive mail from compromised government accounts.
What has not been confirmed
- Attribution to Kazakhstan is a medium-confidence assessment by the researchers, not a confirmed finding.
- What data, if any, was stolen has not been disclosed.
- The names of most affected agencies and the full malware toolset are not disclosed in the report as we have it.
Why this matters
Analysis, not reported fact: phishing from a trusted, already-compromised sender defeats the usual “is this sender known?” check, and hosting payloads on GitHub means a simple domain blocklist will not catch them. Teams in government or serving government clients should treat unexpected attachments from familiar senders as suspect, even when the account is genuine.
What to do
- Update WinRAR and other archive tools to the latest vendor release, and confirm that managed endpoints are not running old builds.
- Block or sandbox executable and script content in archive attachments, and flag documents that ask users to enable content or open unfamiliar archives.
- Hunt for downloads of scripts or binaries from GitHub repositories by non-developer workstations, and for archive tools spawning script interpreters.
- Review mail logs for attachments from partner or government senders that deviate from their normal pattern, and verify unusual requests out of band.
- If you are in the targeted sector, ask your national CERT or the Cisco Talos and Insikt Group reports for indicators of compromise; none are included here.
This story is based on a single outlet’s report of vendor research. We will update it if the underlying Talos or Insikt Group publications add detail.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.