Researchers at Cisco Talos and Recorded Future's Insikt Group have identified a suspected Kazakhstan-linked espionage group, tracked as UAT-6275 and TAG-193, that has run at least eight campaigns since January 2025 against government institutions in nine countries across Central Asia and other former Soviet states. Targets included agencies in Russia, Belarus, Armenia, Uzbekistan, and Tajikistan, with particular interest in foreign affairs, economic development, agriculture, environmental management, and information about regional energy and water supplies.
The researchers assess with medium confidence that the group is tied to Kazakhstan, based on Russian-language malware, evidence of testing from Kazakhstan, and activity aligned with Kazakh working hours. They also note overlap with YoroTrooper, a suspected Kazakhstan-based actor active since 2022. Some operations were timed around diplomatic events: a Tajik government entity was targeted after treaty discussions with Kazakhstan in March 2026, and a Belarusian entity before a bilateral meeting in April.
The group's methods include phishing emails with malicious attachments, sometimes sent from compromised government email accounts, and official-looking documents such as diplomatic correspondence and business proposals. It also used GitHub to host malicious files. In April 2026, researchers observed it exploiting a WinRAR vulnerability (CVE-2025-8088) in an operation likely aimed at Armenia's Ministry of Foreign Affairs—the first time the group was seen using a software flaw for delivery. Researchers expect it to keep targeting diplomatic institutions and agencies managing strategic resources.