UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

Cisco Talos researchers, working with Recorded Future’s Insikt Group, identified the malware and linked the activity to UAT-6275, tracked by Recorded Future as TAG-193.

The archive included ten hidden stream names pointing to the same payload, with different numbers of parent-folder steps. This approach helped account for different extraction locations.

PickleShell is a C#/.NET reverse shell that poses as a Windows service component. The analyzed payload starts a hidden command shell and passes command input and output to its control server. Later builds used encrypted connections.

Earlier activity began with macro-enabled Word documents in June 2025. When a victim enabled macros, the document downloaded and ran another program.

From July, PS2EXE downloaders packaged PowerShell scripts as Windows executables, fetched reverse-shell payloads, and created scheduled tasks to keep running. These stages show that the WinRAR exploit expanded an existing toolkit rather than replacing it.

Four Delivery Paths Support Access

Three exposed staging directories and a previously unreported GitHub repository gave investigators access to payloads, tool lists, and infrastructure changes.

The repository’s history helped trace malware updates and control-server changes. Similar GitHub malware delivery methods appear in unrelated campaigns, underlining why defenders should examine script behavior rather than assume that downloads from a trusted platform are safe.

Observed victims and lure themes covered Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

The targeted work included diplomacy, economic planning, agriculture, environmental management, and energy. Decoys included an Armenian diplomatic letter and a proposal involving Turkmenistan’s Turkmennebit and Russia’s Orsk Oil Refinery, suggesting interest in regional talks and resource supplies.

Talos assessed a Kazakhstan connection with medium confidence, citing language clues, testing submissions, infrastructure access, and working hours consistent with UTC+5.

That assessment does not establish government sponsorship. Investigators also recovered Linux-compatible tools and a public FortiWeb exploit, but the joint paper did not confirm that this actor had exploited FortiWeb systems in the wild.

Security teams should review unexpected Startup-folder files, new scheduled tasks, hidden PowerShell sessions, and scripts downloaded from public repositories, especially when these events follow archive extraction or suspicious email attachments.

The finding also calls for careful incident review: removing the original RAR attachment does not remove a payload already written to Startup. Defenders should connect file creation, process execution, and outbound traffic when checking suspected infections.

Talos published ClamAV signatures and Snort rules for coverage, while the joint technical paper provides hashes and network indicators that can support searches across endpoint records and retained logs during incident response and threat hunting.

Indicators of compromise (IoCs):-

File Hashes

Network and Host Indicators

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.