TAG-193 Espionage Campaign Targets Central Asian and CIS Governments with Spearphishing, WinRAR CVE-2025-8088 and Reverse Shells
Recorded Future's Insikt Group reports on TAG-193, a cluster that ran a sustained intelligence-collection campaign against government bodies from early 2025 through May 2026. Targets include diplomacy, economic development, agriculture and environmental agencies in Russia, Tajikistan, Belarus, Armenia and Uzbekistan. Lure documents and impersonated services point to wider regional interests, including Turkmenistan. Several intrusions coincided with Kazakhstan-related diplomatic events, though the report says this timing does not establish a link or reveal what the operators sought. Insikt assesses that TAG-193 likely operates from Kazakhstan, but its organizational affiliation and state sponsorship remain unresolved. Related reporting from Cisco Talos tracks the activity as UAT-6275, and the Virus Bulletin presentation refers to Silent Lynx.
Detalhes técnicos
- Initial access: spearphishing emails sent from compromised government accounts, with official-looking lures. Identified lures were a diplomatic letter addressed to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia's Orsk Oil Refinery. The lures indicate targeting interest but do not prove successful compromise.
- Infrastructure: public services such as GitHub host malicious scripts and payloads. Exposed directories on TAG-193 infrastructure revealed additional malware and a previously undocumented GitHub staging account.
- Tooling: lightweight interactive reverse shells, including LAPLAS, multiple FoalShell variants and PowerShell-based reverse shells. Four infection-chain types were identified.
- New chain: observed in April 2026 and likely used against Armenia's Ministry of Foreign Affairs. It exploited the WinRAR flaw CVE-2025-8088 to drop malware into the Windows Startup folder, so it executes at the user's next sign-in.
- Capability expansion: Linux-compatible tooling and a publicly available FortiWeb exploit were recovered from the group's infrastructure. Exploitation of FortiWeb in the wild was not confirmed.
- Attribution indicators: Russian-language artifacts, malware-testing submissions from Kazakhstan, and activity patterns consistent with Kazakhstan's working hours.
Remediação
- Protect environmental agencies, forestry platforms, economic ministries, foreign affairs and national security institutions as priority targets.
- Monitor for compromised email accounts, malicious content hosted on trusted public services such as GitHub, and unexpected remote-access activity.
- Patch WinRAR against CVE-2025-8088.
Linha do tempo
-
TAG-193 Espionage Campaign Targets Central Asian and CIS Governments with Spearphishing, WinRAR CVE-2025-8088 and Reverse Shells
ler a análise desta fonte ocultar
Recorded Future's Insikt Group reports on TAG-193, a cluster that ran a sustained intelligence-collection campaign against government bodies from early 2025 through May 2026. Targets include diplomacy, economic development, agriculture and environmental agencies in Russia, Tajikistan, Belarus, Armenia and Uzbekistan. Lure documents and impersonated services point to wider regional interests, including Turkmenistan. Several intrusions coincided with Kazakhstan-related diplomatic events, though the report says this timing does not establish a link or reveal what the operators sought. Insikt assesses that TAG-193 likely operates from Kazakhstan, but its organizational affiliation and state sponsorship remain unresolved. Related reporting from Cisco Talos tracks the activity as UAT-6275, and the Virus Bulletin presentation refers to Silent Lynx.
Technical Details
- Initial access: spearphishing emails sent from compromised government accounts, with official-looking lures. Identified lures were a diplomatic letter addressed to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia's Orsk Oil Refinery. The lures indicate targeting interest but do not prove successful compromise.
- Infrastructure: public services such as GitHub host malicious scripts and payloads. Exposed directories on TAG-193 infrastructure revealed additional malware and a previously undocumented GitHub staging account.
- Tooling: lightweight interactive reverse shells, including LAPLAS, multiple FoalShell variants and PowerShell-based reverse shells. Four infection-chain types were identified.
- New chain: observed in April 2026 and likely used against Armenia's Ministry of Foreign Affairs. It exploited the WinRAR flaw CVE-2025-8088 to drop malware into the Windows Startup folder, so it executes at the user's next sign-in.
- Capability expansion: Linux-compatible tooling and a publicly available FortiWeb exploit were recovered from the group's infrastructure. Exploitation of FortiWeb in the wild was not confirmed.
- Attribution indicators: Russian-language artifacts, malware-testing submissions from Kazakhstan, and activity patterns consistent with Kazakhstan's working hours.
Remediation
- Protect environmental agencies, forestry platforms, economic ministries, foreign affairs and national security institutions as priority targets.
- Monitor for compromised email accounts, malicious content hosted on trusted public services such as GitHub, and unexpected remote-access activity.
- Patch WinRAR against CVE-2025-8088.