UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

UAT-6275 hackers have used a known WinRAR flaw to plant malware on Windows systems while targeting government organizations across the Commonwealth of Independent States (CIS).

The activity shows how an unpatched archive tool can turn a routine attachment into lasting remote access, with the malicious program starting when the victim next signs in.

The campaign involves CVE-2025-8088, a path traversal flaw that lets crafted archives write files outside the folder chosen for extraction.

Researchers observed the group adding this method in April 2026, alongside older attacks using Word macros, executable downloaders, and malicious shortcuts. The wider activity reviewed ran from June 2025 through August 2026.

Cisco Talos researchers, working with Recorded Future’s Insikt Group, identified the malware and linked the activity to UAT-6275, tracked by Recorded Future as TAG-193.

Their October 14 research report describes custom reverse shells named PickleShell, Chvost, and Laplas. These tools let attackers send commands to infected computers and receive the results through remote connections.

UAT-6275 Hackers Exploit WinRAR Flaw

The WinRAR attack, classified as Chain D, used a RAR archive containing two visible PDF decoys. Hidden inside were payload records that abused NTFS alternate data streams, a Windows file feature.

The WinRAR path traversal flaw allowed those records to place PickleShell in the current user’s Startup folder instead of the expected extraction location.

The archive included ten hidden stream names pointing to the same payload, with different numbers of parent-folder steps. This approach helped account for different extraction locations.

A successful write placed the executable in Startup without requiring administrator rights. The malware then ran at the next sign-in, giving the attacker a foothold without another prompt.

PickleShell is a C#/.NET reverse shell that poses as a Windows service component. The analyzed payload starts a hidden command shell and passes command input and output to its control server. Later builds used encrypted connections.

Researchers also found a stable identifier across nine samples, offering defenders another way to hunt for related files despite name changes.

Earlier activity began with macro-enabled Word documents in June 2025. When a victim enabled macros, the document downloaded and ran another program.

From July, PS2EXE downloaders packaged PowerShell scripts as Windows executables, fetched reverse-shell payloads, and created scheduled tasks to keep running. These stages show that the WinRAR exploit expanded an existing toolkit rather than replacing it.

Four Delivery Paths Support Access

From October 2025, malicious shortcuts launched PowerShell to retrieve scripts from GitHub. Later versions also downloaded PickleShell into Startup.

Earlier Silent Lynx phishing campaigns used similar government-themed attachments and shortcuts. Talos reported overlap with Silent Lynx but continues to track UAT-6275 separately from YoroTrooper because direct indicator or toolset overlap between those two groups was not observed.

Three exposed staging directories and a previously unreported GitHub repository gave investigators access to payloads, tool lists, and infrastructure changes.

The repository’s history helped trace malware updates and control-server changes. Similar GitHub malware delivery methods appear in unrelated campaigns, underlining why defenders should examine script behavior rather than assume that downloads from a trusted platform are safe.

Observed victims and lure themes covered Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

The targeted work included diplomacy, economic planning, agriculture, environmental management, and energy. Decoys included an Armenian diplomatic letter and a proposal involving Turkmenistan’s Turkmennebit and Russia’s Orsk Oil Refinery, suggesting interest in regional talks and resource supplies.

Talos assessed a Kazakhstan connection with medium confidence, citing language clues, testing submissions, infrastructure access, and working hours consistent with UTC+5.

That assessment does not establish government sponsorship. Investigators also recovered Linux-compatible tools and a public FortiWeb exploit, but the joint paper did not confirm that this actor had exploited FortiWeb systems in the wild.

Organizations should update affected WinRAR installations to a supported release containing the fix introduced in version 7.13. Other WinRAR exploitation campaigns show why archive software deserves regular patch checks.

Security teams should review unexpected Startup-folder files, new scheduled tasks, hidden PowerShell sessions, and scripts downloaded from public repositories, especially when these events follow archive extraction or suspicious email attachments.

The finding also calls for careful incident review: removing the original RAR attachment does not remove a payload already written to Startup. Defenders should connect file creation, process execution, and outbound traffic when checking suspected infections.

Talos published ClamAV signatures and Snort rules for coverage, while the joint technical paper provides hashes and network indicators that can support searches across endpoint records and retained logs during incident response and threat hunting.

Indicators of compromise (IoCs):-

File Hashes

Type	Source-reported value	File or role
SHA-256	4627cc970b2af15a292e0286820ccec069507c827810b839e1c532a03206353c	Crafted RAR archive exploiting CVE-2025-8088.
SHA-256	392b70086f10c23ce7b4173d1f68d72727ea0146260fb773c78642f6eb641775	PickleShell payload delivered through the WinRAR attack.
SHA-256	cedc4ec0c238b1fc7a71dfa54f7d2d407539d22b87fe1c73b96b7a0dc17d4e40	Macro-enabled Word document representing Chain A.
SHA-256	d12eef4b4b57c0186a166afc6246bf7fb4f668d0a84348c076c4943af1c98838	China–Central Asia Summit campaign sample.
SHA-256	036a60aa2c62c8a9be89a2060e4300476aef1af2fd4d3dd8cac1bb286c520959	PS2EXE downloader associated with targeting Turkmenistan.
SHA-256	a38af45a67fc9070d46649feab0b347011585d1e547fe88185e70dea6e6582ea	Reverse-shell sample classified as Chvost in the joint research.
SHA-256	6806029ed72de2b592c18edb430ffabd56137a8428b7c23860ae4f000a02f0af	Early Chvost sample compiled in June 2022.
SHA-256	697be7589b428f483736486a560f29088e3f8fa03a512b6ca8b606ace0186765	Armenian diplomatic-letter decoy, not a standalone malware payload.

All hashes and their roles above come from the joint technical paper.

Network and Host Indicators

Indicator type	Source-reported value	Role or context
Staging IP addresses	104[.]248[.]17[.]222 62[.]113[.]66[.]137 154[.]205[.]145[.]179	Three publicly accessible directories exposing actor tools and payloads.
PickleShell control endpoint	45[.]130[.]146[.]197:80	Receives command-shell traffic from the analyzed Chain D payload.
Compromised-host control endpoint	geoanswer[.]ru:8443	Legitimate third-party host abused for a PowerShell reverse-shell listener.
Laplas control domain	licensing-mp-microsoft[.]serveexchange[.]com	Domain used by analyzed Laplas TLS variants.
Earlier Chvost endpoint	46[.]243[.]186[.]87:51512	Control endpoint decoded from an earlier sample.
Macro payload URL	hxxp://178[.]128[.]40[.]89:8989/shell.exe	Download location embedded in the Chain A document.
Linux payload URL	hxxp://104[.]248[.]17[.]222/rev.elf	Linux-compatible implant staged on actor infrastructure.
GitHub repository identifiers	xzj4/1 GoBuster7777/asd	Repositories associated with script and payload staging.
Payload filename	rnsdtc.exe	PickleShell executable dropped by the crafted archive.
Persistence directory	%APPDATA%MicrosoftWindowsStart MenuProgramsStartup	Destination used for execution at user sign-in.
PickleShell metadata GUID	be3a4a59-ef3d-4e1c-9501-b5f40be09217	Stable identifier found across nine analyzed samples.
Scheduled tasks	WindowsUpdate MicrosoftOfficeUpdate	Persistence tasks created by analyzed Chain B downloaders.
Macro payload path	%TEMP%update.exe	Local destination used by the analyzed macro downloader.
Script filename	456.ps1	GitHub-hosted PowerShell reverse shell linked to the compromised-host listener.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations appeared first on Cyber Security News.