UAT-6275 hackers have used a known WinRAR flaw to plant malware on Windows systems while targeting government organizations across the Commonwealth of Independent States (CIS).

The activity shows how an unpatched archive tool can turn a routine attachment into lasting remote access, with the malicious program starting when the victim next signs in.

The campaign involves CVE-2025-8088, a path traversal flaw that lets crafted archives write files outside the folder chosen for extraction.

Researchers observed the group adding this method in April 2026, alongside older attacks using Word macros, executable downloaders, and malicious shortcuts. The wider activity reviewed ran from June 2025 through August 2026.

Cisco Talos researchers, working with Recorded Future’s Insikt Group, identified the malware and linked the activity to UAT-6275, tracked by Recorded Future as TAG-193.

Their October 14 research report describes custom reverse shells named PickleShell, Chvost, and Laplas. These tools let attackers send commands to infected computers and receive the results through remote connections.

UAT-6275 Hackers Exploit WinRAR Flaw

The WinRAR attack, classified as Chain D, used a RAR archive containing two visible PDF decoys. Hidden inside were payload records that abused NTFS alternate data streams, a Windows file feature.

The WinRAR path traversal flaw allowed those records to place PickleShell in the current user’s Startup folder instead of the expected extraction location.

Lure document masquerading as a Russian diplomatic congratulatory letter (Source - Cisco Talos) — Lure document masquerading as a Russian diplomatic congratulatory letter (Source – Cisco Talos)

The archive included ten hidden stream names pointing to the same payload, with different numbers of parent-folder steps. This approach helped account for different extraction locations.

A successful write placed the executable in Startup without requiring administrator rights. The malware then ran at the next sign-in, giving the attacker a foothold without another prompt.

PickleShell is a C#/.NET reverse shell that poses as a Windows service component. The analyzed payload starts a hidden command shell and passes command input and output to its control server. Later builds used encrypted connections.

Researchers also found a stable identifier across nine samples, offering defenders another way to hunt for related files despite name changes.

Earlier activity began with macro-enabled Word documents in June 2025. When a victim enabled macros, the document downloaded and ran another program.

From July, PS2EXE downloaders packaged PowerShell scripts as Windows executables, fetched reverse-shell payloads, and created scheduled tasks to keep running. These stages show that the WinRAR exploit expanded an existing toolkit rather than replacing it.

Four Delivery Paths Support Access

From October 2025, malicious shortcuts launched PowerShell to retrieve scripts from GitHub. Later versions also downloaded PickleShell into Startup.

Earlier Silent Lynx phishing campaigns used similar government-themed attachments and shortcuts. Talos reported overlap with Silent Lynx but continues to track UAT-6275 separately from YoroTrooper because direct indicator or toolset overlap between those two groups was not observed.

Three exposed staging directories and a previously unreported GitHub repository gave investigators access to payloads, tool lists, and infrastructure changes.

The repository’s history helped trace malware updates and control-server changes. Similar GitHub malware delivery methods appear in unrelated campaigns, underlining why defenders should examine script behavior rather than assume that downloads from a trusted platform are safe.

Chain C retrieves a GitHub-hosted PowerShell script (Source - Cisco Talos) — Chain C retrieves a GitHub-hosted PowerShell script (Source – Cisco Talos)

Observed victims and lure themes covered Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

The targeted work included diplomacy, economic planning, agriculture, environmental management, and energy. Decoys included an Armenian diplomatic letter and a proposal involving Turkmenistan’s Turkmennebit and Russia’s Orsk Oil Refinery, suggesting interest in regional talks and resource supplies.

Talos assessed a Kazakhstan connection with medium confidence, citing language clues, testing submissions, infrastructure access, and working hours consistent with UTC+5.

That assessment does not establish government sponsorship. Investigators also recovered Linux-compatible tools and a public FortiWeb exploit, but the joint paper did not confirm that this actor had exploited FortiWeb systems in the wild.

Organizations should update affected WinRAR installations to a supported release containing the fix introduced in version 7.13. Other WinRAR exploitation campaigns show why archive software deserves regular patch checks.

Security teams should review unexpected Startup-folder files, new scheduled tasks, hidden PowerShell sessions, and scripts downloaded from public repositories, especially when these events follow archive extraction or suspicious email attachments.

The finding also calls for careful incident review: removing the original RAR attachment does not remove a payload already written to Startup. Defenders should connect file creation, process execution, and outbound traffic when checking suspected infections.

Talos published ClamAV signatures and Snort rules for coverage, while the joint technical paper provides hashes and network indicators that can support searches across endpoint records and retained logs during incident response and threat hunting.

Indicators of compromise (IoCs):-

File Hashes

Type	Source-reported value	File or role
SHA-256	`4627cc970b2af15a292e0286820ccec069507c827810b839e1c532a03206353c`	Crafted RAR archive exploiting CVE-2025-8088.
SHA-256	`392b70086f10c23ce7b4173d1f68d72727ea0146260fb773c78642f6eb641775`	PickleShell payload delivered through the WinRAR attack.
SHA-256	`cedc4ec0c238b1fc7a71dfa54f7d2d407539d22b87fe1c73b96b7a0dc17d4e40`	Macro-enabled Word document representing Chain A.
SHA-256	`d12eef4b4b57c0186a166afc6246bf7fb4f668d0a84348c076c4943af1c98838`	China–Central Asia Summit campaign sample.
SHA-256	`036a60aa2c62c8a9be89a2060e4300476aef1af2fd4d3dd8cac1bb286c520959`	PS2EXE downloader associated with targeting Turkmenistan.
SHA-256	`a38af45a67fc9070d46649feab0b347011585d1e547fe88185e70dea6e6582ea`	Reverse-shell sample classified as Chvost in the joint research.
SHA-256	`6806029ed72de2b592c18edb430ffabd56137a8428b7c23860ae4f000a02f0af`	Early Chvost sample compiled in June 2022.
SHA-256	`697be7589b428f483736486a560f29088e3f8fa03a512b6ca8b606ace0186765`	Armenian diplomatic-letter decoy, not a standalone malware payload.

All hashes and their roles above come from the joint technical paper.

Network and Host Indicators

Indicator type	Source-reported value	Role or context
Staging IP addresses	`104[.]248[.]17[.]222` `62[.]113[.]66[.]137` `154[.]205[.]145[.]179`	Three publicly accessible directories exposing actor tools and payloads.
PickleShell control endpoint	`45[.]130[.]146[.]197:80`	Receives command-shell traffic from the analyzed Chain D payload.
Compromised-host control endpoint	`geoanswer[.]ru:8443`	Legitimate third-party host abused for a PowerShell reverse-shell listener.
Laplas control domain	`licensing-mp-microsoft[.]serveexchange[.]com`	Domain used by analyzed Laplas TLS variants.
Earlier Chvost endpoint	`46[.]243[.]186[.]87:51512`	Control endpoint decoded from an earlier sample.
Macro payload URL	`hxxp://178[.]128[.]40[.]89:8989/shell.exe`	Download location embedded in the Chain A document.
Linux payload URL	`hxxp://104[.]248[.]17[.]222/rev.elf`	Linux-compatible implant staged on actor infrastructure.
GitHub repository identifiers	`xzj4/1` `GoBuster7777/asd`	Repositories associated with script and payload staging.
Payload filename	`rnsdtc.exe`	PickleShell executable dropped by the crafted archive.
Persistence directory	`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\`	Destination used for execution at user sign-in.
PickleShell metadata GUID	`be3a4a59-ef3d-4e1c-9501-b5f40be09217`	Stable identifier found across nine analyzed samples.
Scheduled tasks	`WindowsUpdate` `MicrosoftOfficeUpdate`	Persistence tasks created by analyzed Chain B downloaders.
Macro payload path	`%TEMP%\update.exe`	Local destination used by the analyzed macro downloader.
Script filename	`456.ps1`	GitHub-hosted PowerShell reverse shell linked to the compromised-host listener.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations appeared first on Cyber Security News.