UAT-6275: How to Detect & Block Kazakhstan-Nexus Reverse Shells

Executive Summary

A joint threat intelligence investigation by Cisco Talos and Recorded Future’s Insikt Group has uncovered sophisticated cyber espionage campaigns orchestrated by UAT-6275 (also tracked as TAG-193 and Silent Lynx). Active since at least mid-2025, the threat cluster exhibits a medium-confidence Kazakhstan nexus, evidenced by developer artifacts in Russian, local working hours matching UTC+5, operational infrastructure access, and early malware testing telemetry originating from within Kazakhstan.

The group primarily conducts intelligence gathering against government ministries, diplomatic missions, and critical resource infrastructure across nine Commonwealth of Independent States (CIS) and Central Asian nations: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. High-priority targets include bilateral treaty negotiators, environmental management ministries, Uzbekistan’s Smart Forestry initiative, and vital oil refining infrastructure such as the Orsk Oil Refinery and Turkmennebit.

Operational security (OpSec) misconfigurations on attacker infrastructure—including three publicly accessible HTTP staging directories and an exposed GitHub repository—provided researchers with direct visibility into active development branches, tool inventories, and command-and-control (C2) rotation pipelines.

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

Telemetry analysis reveals that UAT-6275 evolved its operational deployment strategy through four distinct infection vectors (Chains A through D), shifting progressively from basic email lure documents to zero-day and n-day archive vulnerability exploitation.

[Chain A: Word Macro]   --> Drops Second-Stage EXE       --> Establishes Scheduled Task
[Chain B: PS2EXE Binary]--> Downloads Remote Payloads    --> Establishes Scheduled Task
[Chain C: LNK Shortcut] --> Executes GitHub PowerShell   --> Startup Folder Persistence
[Chain D: WinRAR RAR]   --> Exploits CVE-2025-8088 Traversal --> Drops PickleShell in Startup

1. Chain A (Macro-Enabled Documents): Observed in June 2025, lures impersonating diplomatic correspondence (such as Armenian MFA letters or Central Asia summit documents) execute embedded Visual Basic for Applications (VBA) code. The macro writes a secondary binary payload directly to disk and executes it via standard Windows API calls.
2. Chain B (PS2EXE Downloaders): Emerged in July 2025. Operators compile PowerShell downloaders into standalone portable executables using the open-source PS2EXE utility. Upon execution, the compiled binary retrieves lightweight reverse shells from remote HTTP staging servers and establishes persistence via Windows Scheduled Tasks (schtasks.exe).
3. Chain C (Malicious LNK & GitHub Staging): Observed in October 2025. Phishing attachments deliver crafted Windows shortcuts (.lnk) that spawn hidden PowerShell instances. The script downloads remote stages hosted on attacker-controlled public GitHub repositories, deploying PickleShell or Chvost reverse shells into %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup for user-level persistence.
4. Chain D (WinRAR CVE-2025-8088 Exploitation): Identified in April 2026. Attackers weaponized a directory traversal flaw in WinRAR archive extraction (CVE-2025-8088). When a victim uncompresses the malicious .rar file, the utility writes PickleShell directly to the Windows Startup folder outside the intended extraction path. The payload automatically executes upon the user's next interactive logon session without requiring elevated administrative privileges.

Payloads & Post-Exploitation Tooling

The threat actor deploys several custom and commodity interactive shells:

• PickleShell: A lightweight Python-based or compiled reverse shell capable of executing arbitrary shellcode, staging file downloads, and spawning interactive command sessions back to dynamic DNS C2 nodes.
• Chvost & Laplas: Compact remote access utilities that maintain encrypted sockets and execute localized batch or PowerShell commands.
• Linux & Edge Appliance Tools: Exposed staging directories revealed compiled Linux binaries (linux-update-repos.elf, rev.elf, ligolo-mp_linux_amd64, and fscan), as well as a staged proof-of-concept exploit targeting FortiWeb (CVE-2025-25257), indicating an active transition toward compromising perimeter enterprise appliances.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Cisco Talos and Recorded Future correlate UAT-6275 with historical reporting from Seqrite under the Silent Lynx moniker. While overlapping operational markers connect the group to the broader YoroTrooper espionage umbrella first reported in 2023 (as well as related clusters tracked as Tomiris, ShadowSilk, Cavalry Werewolf, and Hydra Saiga), lack of direct code reuse warrants maintaining a discrete tracking cluster.

Attribution to a Kazakhstan nexus is supported by multi-source telemetry:

• Developer Working Hours: Commit analysis across 77 repository interactions aligns with 09:00–18:00 working days in UTC+5 (Kazakhstan standard time), with secondary overlap in UTC+3.
• Language & Linguistic Markers: Configuration keys, commit comments, and debugging strings feature native Russian colloquialisms standard in Central Asian administrative environments.
• Staging Infrastructure Testing: Initial sample uploads to multi-scanner engines consistently originated from IP space within Kazakhstan minutes after payload compilation.
• Target Prioritization: Deep operational focus on regional water treaties, cross-border energy logistics (Orsk-Turkmennebit oil pipeline ties), and bilateral CIS diplomatic summit negotiations.

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Defenders must execute the following hardening and audit measures across all domain-joined and standalone Windows environments:

Step 1: Audit and Clear Unauthorized Startup Artifacts Inspect user Startup folders for untrusted executables, VBScript wrappers, or Python binaries dropped by archive tools:

# Query all Startup folder items across user profiles
Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup", "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" -Recurse | 
    Select-Object Name, FullName, Length, CreationTime, LastWriteTime | 
    Format-Table -AutoSize

Step 2: Patch WinRAR & Archive Extractors Ensure all host endpoints are running WinRAR version 7.12 or later to neutralize CVE-2025-8088 directory traversal flaws. Where feasible, enforce centralized extraction via managed utilities like 7-Zip (patched) with execution sandboxing.

Step 3: Restrict Script Execution and Constrained Language Mode Enforce PowerShell ConstrainedLanguage mode via AppLocker or Software Restriction Policies (SRP) to prevent ad-hoc web client invocations from downloading GitHub-hosted payloads:

# Enforce PowerShell ConstrainedLanguage mode system-wide via environment variable
[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

Step 4: Block Dynamic DNS & High-Risk Dynamic Hosting Providers Block outbound perimeter traffic and DNS resolution to dynamic DNS domains commonly abused by UAT-6275, including *.ddns.me, *.servehttp.com, *.serveftp.com, *.zapto.org, and *.hopto.me.

2. Network & Perimeter Defenses

• Snort IDS Signatures: Deploy Cisco Snort rules covering active UAT-6275 network communications:
  • Snort 2: 1:11192, 1:15306, 1:46983, 1:47398
  • Snort 3: 1:46983, 4:16
• Egress Boundary Filtering: Restrict outbound TCP connections on ports 8000, 8081, and 8989 directly to external non-standard IP ranges.
• GitHub Raw Staging Scrutiny: Inspect egress HTTP proxy logs for anomalous requests to raw.githubusercontent.com containing standalone .ps1 or .exe paths spawned by non-browser parent processes (e.g. powershell.exe, cmd.exe, wscript.exe).

3. Endpoint Detection & Hunting Query

Sigma Rule: UAT-6275 Startup Directory Payload Drop & Execution

title: Suspicious File Creation or Execution in Startup Folder via Scripting
id: d73f2a41-6e11-4f10-9c2b-8a4b60e227a1
status: experimental
description: Detects the creation or execution of executable and script files in the Windows Startup folder by archive extractors or PowerShell processes, characteristic of UAT-6275 PickleShell persistence.
author: CyberNewsAI Threat Research Team
references:
  - https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/
logsource:
  category: file_event
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\Microsoft\Windows\Start Menu\Programs\Startup\'
    TargetFilename|endswith:
      - '.exe'
      - '.vbs'
      - '.ps1'
      - '.bat'
      - '.py'
  selection_initiator:
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_target and selection_initiator
falsepositives:
  - Legitimate administrative software installers run with explicit user consent
level: high
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1059.001

Microsoft Sentinel / Defender KQL Hunting Query

// Hunt for processes spawning from Startup folder or suspicious script downloads from GitHub
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where (FolderPath has @"\Microsoft\Windows\Start Menu\Programs\Startup" and FileName endswith_any (".exe", ".vbs", ".ps1"))
    or (ProcessCommandLine has_all ("raw.githubusercontent.com", "powershell") and ProcessCommandLine has_any (".ps1", "1.ps1", "Invoke-Expression", "IEX"))
| extend InitiatingProcess = InitiatingProcessFileName, TargetFile = FileName, CommandLine = ProcessCommandLine
| project Timestamp, DeviceName, AccountName, InitiatingProcess, TargetFile, CommandLine, FolderPath
| sort by Timestamp desc

Splunk SPL Hunting Query

index=endpoint sourcetype=WinEventLog:Security EventCode=4688
| eval CommandLine=lower(Process_Command_Line), NewProcess=lower(New_Process_Name)
| where (like(NewProcess, "%\microsoft\windows\start menu\programs\startup\%") AND (like(NewProcess, "%.exe") OR like(NewProcess, "%.vbs") OR like(NewProcess, "%.ps1")))
     OR (like(CommandLine, "%raw.githubusercontent.com%") AND (like(CommandLine, "%powershell%") OR like(CommandLine, "%iex%") OR like(CommandLine, "%downloadstring%")))
| table _time, host, user, ParentProcessName, New_Process_Name, Process_Command_Line

The following Indicators of Compromise represent authenticated indicators recovered from the Cisco Talos / Recorded Future authoritative research repository.

Malware File Hashes (SHA-256)

Network C2 Domains & Staging Infrastructure