THE CRUNCH
A cyber-espionage group with suspected ties to Kazakhstan has run at least eight campaigns since January 2025 against government agencies across Central Asia and other former Soviet states, according to joint research from Cisco Talos and Recorded Future's Insikt Group. The teams track the group as UAT-6275 and TAG-193 respectively. Targets or targets of interest span nine countries, including Russia, Belarus, Armenia, Uzbekistan and Tajikistan, with a focus on foreign affairs, economic development, agriculture and environmental management, plus regional energy and water resources.
The researchers assessed with medium confidence that the group is Kazakhstan-linked, citing Russian-language material in the malware, evidence the software was tested from Kazakhstan shortly after it was built, and activity matching the country's working hours. Its operations also overlap with YoroTrooper, a suspected Kazakhstan-based actor active since 2022.
Timing appears deliberate: one attack hit a Tajik government entity shortly after treaty talks with Kazakhstan in March 2026, and another targeted a Belarusian agency before a bilateral meeting in April. The researchers say this could indicate interest in diplomatic developments, though it does not show what information was sought or taken.
The group's main entry route is phishing with official-looking attachments, sometimes sent from already compromised government email accounts, with malicious files hosted on GitHub to blend in. In April 2026 it was observed exploiting a WinRAR flaw, tracked as CVE-2025-8088, in an operation likely aimed at Armenia's foreign ministry, the first time the researchers saw it use a software vulnerability rather than deceptive emails alone.