Kazakhstan-linked hackers spy on ex-Soviet governments

A cyber-espionage group suspected of having ties to Kazakhstan has been going after government agencies in Central Asia and other former Soviet states. The group was looking for information on diplomacy, economic policy and strategic resources, according to joint research by Cisco Talos and Recorded Future's Insikt Group.

Cisco Talos tracks the group as UAT-6275, while Insikt Group calls it TAG-193. The two teams said the actor has run at least eight campaigns since January 2025.

Nine countries in the crosshairs

The researchers found government institutions in nine countries that were either targeted or of clear interest to the group. These include Russia, Belarus, Armenia, Uzbekistan and Tajikistan.

The group focused mainly on agencies that handle foreign affairs, economic development, agriculture and environmental management. It also sought information on regional energy supplies and water resources.

"These organizations hold information that can inform negotiations, economic planning, and regional security decisions," the Insikt Group said. "Across Central Asia, shared river systems and interconnected energy and transport infrastructure give such information particular strategic value."

Some of the operations closely followed diplomatic events. In March 2026, the hackers went after a Tajik government entity shortly after treaty discussions with Kazakhstan. Another operation hit a Belarusian government entity ahead of a bilateral meeting in April.

The researchers said this timing could point to an interest in diplomatic developments. They added that it does not show what information the attackers were after, or whether they got it.

Natural resources were another theme. Targets included an Armenian government agency responsible for environmental affairs and Uzbekistan's Smart Forestry initiative.

Why Kazakhstan?

The researchers assessed with medium confidence that the group is linked to Kazakhstan. They based this on three clues:

• Russian-language material found in the malware
• signs that the malicious software was tested from Kazakhstan shortly after it was built
• activity that generally matched working hours in Kazakhstan's time zone

The operations also overlap with earlier espionage campaigns attributed to YoroTrooper. That suspected Kazakhstan-based threat actor first surfaced in 2022 and has mostly targeted governments in Central Asia and neighboring countries.

Phishing, GitHub and a WinRAR flaw

The group's usual entry point is a phishing email with a malicious attachment. In some cases, these emails came from legitimate government accounts that had already been compromised, which makes them much harder for recipients to spot. The lures were official-looking documents such as diplomatic correspondence, aviation forms and business proposals.

The attackers also hosted malicious scripts and files on GitHub, the software development platform. This helped their traffic blend in with legitimate online activity.

In April 2026, the group was seen exploiting CVE-2025-8088, a vulnerability in the WinRAR file compression program. The operation likely targeted Armenia's Ministry of Foreign Affairs. The flaw let the attackers drop malware into a Windows folder that automatically runs programs when a user signs in, which gave them a foothold that survives a reboot.

The researchers said this was the first time they had observed the group exploiting a software vulnerability to deliver malware. In their view, it shows the actor is expanding beyond deceptive emails and documents.

They expect the group to keep targeting diplomatic institutions and agencies that manage strategic resources across the region. "Its sustained operations and adoption of additional delivery techniques suggest continued investment in gaining access to institutions holding information of strategic interest," they said.

Our Take

Cyber-espionage reporting tends to focus on large state actors from Russia, China, Iran and North Korea. This research is a reminder that smaller regional players run their own intelligence operations. They pick targets based on local priorities, such as water, energy and treaty negotiations, rather than global ones. Rivers and energy networks crossing several borders make that information valuable to neighbors, and the group's choice of targets reflects this.

The attack methods are familiar. Document-based phishing against government staff remains a reliable way in, as recent campaigns like UAC-0099's MATCHBOIL operations against Ukraine also show. Emails sent from hijacked government accounts are especially dangerous. Sender reputation checks offer little protection when the sender really is a trusted ministry. For defenders, this suggests that restricting risky attachment types and checking for unusual autostart entries may matter more than training users to spot suspicious senders.

The move to exploiting a WinRAR flaw is the development to watch. Archive tools often get updated less reliably than browsers or operating systems, so they are an attractive target. Organizations in the region should check which WinRAR versions are running on their systems. It is also worth watching whether the group adopts more vulnerabilities in future campaigns, and whether further research strengthens the medium-confidence attribution to Kazakhstan.