Kazakhstan-Linked Hackers Shadow Regional Diplomacy in Eight-Campaign Espionage Run

Two threat-intelligence teams assess that a Kazakhstan-based cluster is timing intrusions to treaty talks and bilateral meetings across the former Soviet space.

Intelligence Lead

A state-aligned espionage cluster assessed to be operating from Kazakhstan has run at least eight campaigns since January 2025 against government bodies in nine countries, including Russia and Belarus. Cisco Talos and Recorded Future's Insikt Group attribute the activity to Kazakhstan with medium confidence, which would make it a rare case of a Central Asian state-aligned actor spying on a Russian-led security partner.

Situation Report

Talos tracks the cluster as UAT-6275 and Insikt Group as TAG-193, according to The Record, which reported the research on 15 October. Targets reportedly include foreign affairs, economic development, agriculture and environment agencies in nine countries, among them Russia, Belarus, Armenia, Uzbekistan and Tajikistan. Researchers also point to interest in regional energy supplies and water resources.

The timing of the intrusions is the most notable feature. A Tajik government entity was reportedly targeted shortly after treaty discussions with Kazakhstan in March 2026, and a Belarusian entity ahead of a bilateral meeting in April. An April operation likely targeted Armenia's Ministry of Foreign Affairs. The researchers say the timing could indicate interest in diplomacy, but they do not establish what was sought or whether any data was taken.

Reuters, reporting on a joint Cisco and Recorded Future study on 14 October, describes an actor it calls Silent Lynx, "likely based in Kazakhstan." That account adds a break-in at the Nizhny Novgorod city government and the targeting of the Orsk oil refinery in southern Russia, which was reportedly knocked out for months after a Ukrainian drone strike in August. The two accounts appear to describe the same research, but neither names the other's actor label, and the overlap is not confirmed.

Delivery relied on phishing emails with malicious attachments, some sent from compromised legitimate government accounts. Lures included diplomatic correspondence, aviation forms and business proposals. The cluster hosted malicious files on GitHub. In April 2026 it was observed for the first time exploiting a software flaw, CVE-2025-8088 in WinRAR, which allowed malware to be placed in a Windows startup folder.

Background & Context

Talos documented a related Kazakhstan-attributed group, YoroTrooper, in 2023. That group was first detected in June 2022 and used phishing and custom Python remote access trojans against former Soviet republics. Talos assessed with high confidence at the time that it had worked to disguise its origin, routing traffic through Azerbaijan-hosted infrastructure. The newer reporting notes overlap with YoroTrooper campaigns, but no published account confirms that the clusters are identical.

The attribution rests on circumstantial indicators: Russian-language material in the malware, testing from Kazakhstan shortly after the malware was compiled, activity matching Kazakh working hours, and targeting that aligns with Kazakhstan's strategic interests. These are consistent with Kazakh origin. They do not prove state direction, and a criminal or contractor operation cannot be excluded.

Kazakhstan is a member of the Russian-led Collective Security Treaty Organisation and the Eurasian Economic Union. Astana has balanced Moscow, Beijing and the West since the 2022 invasion of Ukraine. Kazakh, Russian, Tajik and Belarusian authorities did not respond to Reuters' requests for comment.

Analysis & Assessment

It is assessed with moderate confidence that the cluster serves a state intelligence requirement rather than financial motives. The target set is diplomatic and resource-focused, there is no reported extortion or monetisation, and intrusions follow negotiation calendars. That pattern suggests collection intended to give Astana advance insight into counterparts' positions on borders, water and energy before talks.

The first use of a vulnerability exploit is a capability signal. Operators who previously relied on social engineering and commodity tooling are now adopting techniques that need more development and testing. The researchers cite sustained investment in access to institutions holding strategic information. That points to a maturing programme rather than opportunistic activity.

The principal alternative is a private or contracted actor working to Kazakh interests without formal tasking. The available reporting cannot separate the two. Defenders in the region should treat the cluster as persistent, particularly foreign ministries and agencies holding water and energy data, and should patch WinRAR.