Explore joint Cisco Talos and Recorded Future research on TAG-193's cyber-espionage operations targeting government across Central Asia and the wider Commonwealth of Independent States (CIS)

TL;DR Security researchers uncovered an active espionage campaign led by the UAT-6275 threat actor against government agencies across the Commonwealth of Independent States (CIS). Between June 2025 and August 2026, the group deployed four distinct infection chains, including a WinRAR vulnerability exploit. Moreover, operational security mistakes exposed the group's staging servers and GitHub repositories to investigators. What Happened in the Campaigns…

Talos and Recorded Future identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. Recovered artifacts show additional interest in water resources...

Groups Conversations All groups and messages Sign in Technical - Security Conversations About Privacy • Terms     TAG-193’s Regional Espionage Operations 0 views Skip to first unread message Eyal Estrin unread, 9:45 PM (16 minutes ago)    to https://www.recordedfuture.com/blog/tag193-regional-espionage-operations Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward