# Suspected Kazakh Espionage Group Intensifies Operations in Central Asia New research from **Cisco Talos** and **Recorded Future's Insikt Group** reveals an active cyber-espionage campaign targeting governmental entities in Central Asia and other former Soviet nations. The threat actor, identified as **UAT-6275** by **Cisco Talos** and **TAG-193** by **Recorded Future**, has conducted at least eight campaigns since January 2025. ## Broad Scope of Targets and Interests The campaigns have demonstrated interest in or directly targeted government institutions across nine countries, including Russia, Belarus, Armenia, Uzbekistan, and Tajikistan. Researchers note a particular focus on agencies responsible for foreign affairs, economic development, agriculture, and environmental management. Information regarding regional energy supplies and water resources also appears to be a high-priority target. According to the **Insikt Group**, "These organizations hold information that can inform negotiations, economic planning, and regional security decisions. Across Central Asia, shared river systems and interconnected energy and transport infrastructure give such information particular strategic value." ## Unpacking the Kazakhstan Nexus While direct attribution remains with medium confidence, several clues suggest a link to Kazakhstan. These include Russian-language artifacts within the malware, evidence of malicious software testing from Kazakhstan shortly after creation, and operational activity aligning with Kazakhstani working hours. Furthermore, **TAG-193**'s operations show overlap with prior cyber-espionage campaigns attributed to **YoroTrooper**, another suspected Kazakhstan-based threat actor active since 2022, primarily targeting governments in Central Asia and neighboring regions. Intriguingly, some attacks coincided with significant diplomatic events. For instance, a Tajik government entity was targeted after treaty discussions with Kazakhstan in March 2026, and a Belarusian entity was hit before a bilateral meeting in April. This timing suggests an interest in diplomatic developments, though the specific information sought or obtained remains unconfirmed. The group also exhibited interest in environmental and natural resource management, observed in targeting an Armenian government agency for environmental affairs and Uzbekistan's Smart Forestry initiative. ## Evolving Attack Techniques Initially, the group heavily relied on phishing emails containing malicious attachments. These emails often masqueraded as official diplomatic correspondence, aviation forms, or business proposals, sometimes originating from already compromised legitimate government email accounts. **TAG-193** has also leveraged **GitHub** to host malicious scripts and files, a tactic that helps their operations blend in with legitimate software development activities. A significant development in April 2026 saw the group exploiting a security vulnerability in the **WinRAR** file compression program. This flaw, tracked as **CVE-2025-8088**, allowed attackers to deploy malware into a Windows folder that automatically executes programs upon user login. This operation likely targeted Armenia's Ministry of Foreign Affairs. This exploitation marks a notable shift, indicating the group is expanding its toolkit beyond social engineering and deceptive documents. Researchers anticipate continued targeting of diplomatic institutions and agencies managing strategic resources, with sustained investment in gaining access to information of strategic interest.