Suspected Kazakhstan-Linked Spy Group Targets Government Agencies Across Former Soviet States

A cyber-espionage group with suspected ties to Kazakhstan has been targeting government agencies across Central Asia and other former Soviet states, according to new research. Cisco Talos tracks the group as UAT-6275, while Recorded Future's Insikt Group calls it TAG-193. The two teams say it has carried out at least eight campaigns since January 2025, with targets or interest spanning nine countries, including Russia, Belarus, Armenia, Uzbekistan and Tajikistan.

The researchers said the group appeared most interested in agencies responsible for foreign affairs, economic development, agriculture and environmental management, along with information on regional energy supplies and water resources. They assessed with medium confidence that the group is tied to Kazakhstan. Clues include Russian-language material in the malware, signs that malicious software was tested from Kazakhstan soon after being created, and activity that generally matched working hours in that time zone. The group's operations also overlap with YoroTrooper, a suspected Kazakhstan-based actor that emerged in 2022.

Some attacks appear to have been timed around diplomatic events. One targeted a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026, and another hit a Belarusian government entity ahead of a bilateral meeting in April. Researchers cautioned that the timing does not show what the hackers wanted or whether they obtained it.