Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Cisco Talos, in collaboration with Recorded Future’s Insikt Group, has uncovered a campaign targeting government organizations across the Commonwealth of Independent States (CIS) led by the UAT-6275 threat actor. The investigation revealed a previously unreported GitHub repository containing tools and malware, alongside three publicly accessible staging directories. The group utilizes various techniques, including malicious documents, PS2EXE downloaders, and GitHub-hosted PowerShell, to deliver malware and establish remote access.