Exposed Servers Reveal How a Kazakhstan-Linked Group Targets Central Asian Governments

Cisco Talos and Recorded Future's Insikt Group have jointly investigated UAT-6275, a threat actor targeting government organisations across the Commonwealth of Independent States (CIS). Researchers found three publicly accessible staging directories and a previously unreported GitHub repository that hosted malicious scripts and payloads. These exposed assets showed how the group develops its malware, changes its infrastructure and prepares further intrusions.

Talos tracks the group as UAT-6275, while Recorded Future calls it TAG-193. It overlaps with Silent Lynx and sits within a wider set of campaigns tied to YoroTrooper. Other vendors have reported overlapping indicators under names such as Tomiris, ShadowSilk, Cavalry Werewolf and Hydra Saiga. Talos believes UAT-6275 and YoroTrooper likely belong to the same broader cluster, but tracks them separately because it has not seen direct indicator or toolset overlap.

Victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. The group focuses on bodies responsible for diplomacy, economic development, agriculture and environmental management, which hold information useful for negotiations and planning. Network analysis showed activity involving a Tajik government entity shortly after March 2026 treaty talks with Kazakhstan, and a Belarusian entity ahead of an April bilateral meeting. This timing may point to an interest in regional diplomacy. The full technical analysis and indicators of compromise are in the Virus Bulletin 2026 white paper.