Cisco Talos and Recorded Future say Kazakhstan-nexus UAT-6275 ran a mixed espionage campaign from June 2025 through August 2026 against CIS government organizations, with added interest in water resources and energy. The group used macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive tied to CVE-2025-8088.
The same research found three public staging directories and a GitHub repository that exposed payload builds, tool inventories, and command-and-control changes. Talos also saw preparation for Linux hosts and internet-facing appliances, and flagged a FortiWeb proof of concept tied to CVE-2025-25257, which makes exposed Windows file handling and web appliances part of the same intrusion path.
For defenders, the key shift is that this campaign is no longer just about tailored document delivery to a regional target set. Any internet-facing FortiWeb instance or Windows host that trusts external archives or office files can sit in the same blast radius as the CIS organizations Talos tracked.
CVSS 9.8 CRITICAL: an improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89]… EPSS 100% (100th percentile).
CVSS 8.8 HIGH: a path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. EPSS 94% (100th percentile).