Hackers tied to Kazakhstan used a WinRAR flaw to spy on CIS governments

Key points

• Cisco Talos and Recorded Future's Insikt Group say a hacking crew they call UAT-6275, also tracked as Silent Lynx, spent from June 2025 to August 2026 breaking into government offices across the Commonwealth of Independent States, the loose grouping of former Soviet republics.
• The attackers used a booby-trapped WinRAR file that exploits CVE-2025-8088, a flaw in the popular file-compression tool that lets a rigged archive drop files into places the user never agreed to.
• Talos also found interest in water and energy organisations, which the researchers link to the regional fallout from the Russia-Ukraine war.
• The group left three staging folders and a GitHub repository open to the public, exposing its own malware builds and command servers.

A hacking group that researchers believe operates out of Kazakhstan has spent more than a year quietly breaking into government networks across the former Soviet bloc, and it got caught partly because it forgot to lock its own cupboards.

The findings come from a joint investigation by Cisco Talos and Julian-Ferdinand Vögele of Recorded Future's Insikt Group, published on 14 October 2026. Talos calls the crew UAT-6275; other analysts know it as Silent Lynx. The Hacker News flagged the campaign the same week.

Who did they hit, and why?

Government organisations across the Commonwealth of Independent States, with extra interest in water and energy bodies. Talos says the pattern fits classic intelligence collection and likely tracks the regional pressures from the Russia-Ukraine war.

The CIS is the loose club of countries that stayed in touch after the Soviet Union broke up. Spying on neighbours' ministries isn't new. What's useful here is the window Talos got into how a mid-tier state-aligned crew actually works day to day.

How did the attackers get in?

Four different ways, run in parallel between June 2025 and August 2026. All of them end with a custom reverse shell, a small program that phones home and gives the attacker a live command line on the victim's computer.

The WinRAR piece is the one defenders should care about most. CVE-2025-8088 lets a crafted archive write files to locations the user didn't choose, including places Windows runs automatically at login. Open the attachment, and the machine is theirs at the next reboot. We first covered this vulnerability on 2 June 2026, when Gamaredon was still riding it into Ukrainian endpoints months after a patch was available. It's now appearing in a second, unrelated campaign.

How did researchers see so much?

The group left the lights on. Three staging directories sat on the public internet with no password. A GitHub repository kept its full history, including payload builds and edits to the command-and-control servers the malware calls back to. That's a dream for an analyst and a career-ending mistake for whoever set it up. The failure mode is familiar: operators treat a staging box as temporary and never come back to lock it.

Should you worry about FortiWeb too?

If you run Fortinet's FortiWeb web application firewall in this region, check your patch status now. Fortinet has confirmed active exploitation of an unauthenticated SQL injection flaw in that product. Our 13 August 2026 story on Fortinet's patch round has the details. Different attacker, same region, same week in the inbox.

Patch WinRAR, block macros on inbound Office documents by default, and watch for PowerShell processes reaching out to raw GitHub URLs.

The post-mortem on this one will note that the hard part wasn't the malware. It was the year nobody noticed the macros.