Key points
- UAT-6275 targets CIS government, water, energy and environmental organisations using four distinct infection chains active from June 2025.
- The group exploited CVE-2025-8088 in WinRAR to achieve persistence without elevated privileges, marking a shift from previous macro-based methods.
- Attackers deployed custom reverse shells including PickleShell, Chvost and Laplas to maintain interactive access on compromised Windows systems.
Government employees and utility sector staff across the Commonwealth of Independent States face heightened risk from espionage group UAT-6275. Security researchers identified four active infection chains targeting these organisations from June 2025 through 2026, with a specific focus on water, environmental and energy infrastructure.
The campaign evolved significantly in April 2026 when attackers began exploiting CVE-2025-8088, a path-traversal vulnerability in WinRAR. This method allowed them to write the PickleShell reverse shell into the user’s Startup folder, establishing persistence without requiring elevated privileges. According to Talos, this was the first observed vulnerability exploit within the group’s malware-delivery chain.
Evolution of attack methods
Earlier stages of the campaign relied on social engineering and script execution. In June 2025, attackers used macro-enabled Word documents to download second-stage payloads. By July, they shifted to PS2EXE-built executables containing PowerShell scripts that established persistence via scheduled tasks. An October 2025 chain used malicious Windows shortcuts to launch GitHub-hosted PowerShell scripts.
These methods delivered lightweight reverse shells, granting operators interactive access to compromised Windows systems. The progression towards exploiting a specific software vulnerability in WinRAR indicates a maturation in the group’s technical capabilities and a desire for more reliable persistence mechanisms.
Target sectors and scope
The primary targets are government organisations within the CIS region, with additional interest in critical infrastructure sectors. Recorded Future tracks the activity under the designation TAG-193. Researchers suggest the regional focus may reflect intelligence priorities shaped by the effects of the Russia–Ukraine war, though no direct operational link was confirmed.
Our take on the response
The introduction of CVE-2025-8088 exploitation marks a critical escalation in the UAT-6275 campaign. Moving from macro-based attacks to software vulnerability exploitation reduces reliance on user interaction, making detection more difficult. Security teams should prioritise patching WinRAR installations and monitoring for unusual PowerShell activity, particularly scripts sourced from GitHub or executed via malicious shortcuts.
What affected people can do
Employees in targeted sectors should verify their WinRAR versions immediately and check for unexpected executable files in startup folders. Review scheduled tasks and PowerShell execution logs for anomalies, especially those originating from external repositories. Be cautious with Word documents containing macros, even from known contacts, as these remain a primary vector. Report any unusual system behaviour or unexpected login prompts to your security team without delay.
What to do and how to stay safe: UAT-6275
- Ensure all WinRAR installations are updated to the latest version that addresses CVE-2025-8088.
- Monitor endpoint detection and response logs for PowerShell scripts executing from unusual paths or external sources.
- Restrict the execution of macro-enabled documents and PS2EXE-generated executables through application control policies.
- Audit user startup folders and scheduled tasks for unauthorized persistence mechanisms like PickleShell or Chvost.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the specific vulnerability used in the WinRAR exploit?
The attackers exploited CVE-2025-8088, a path-traversal vulnerability in WinRAR, to write payloads into the user’s Startup folder.
Which sectors are being targeted by UAT-6275?
The campaign targets government organisations, as well as water, environmental and energy sectors across the Commonwealth of Independent States.
What reverse shells are associated with this campaign?
The group uses custom reverse shells named Chvost, Laplas and PickleShell to maintain interactive command execution on compromised systems.