UAT-6275 weaponizes WinRAR CVE-2025-8088 against CIS governments

Cisco Talos and Recorded Future's Insikt Group have detailed an espionage campaign against government bodies across the Commonwealth of Independent States that, from April 2026, began delivering malware through a WinRAR path-traversal flaw. The primary source is Talos's writeup, Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (October 14), published in coordination with Recorded Future, which tracks the activity as TAG-193. Some outlets map both to the actor known as Silent Lynx.

The flaw

The delivery vehicle is CVE-2025-8088, a path-traversal bug in the Windows build of WinRAR that lets a crafted RAR archive write files outside the extraction directory. ESET researchers discovered it being exploited in the wild as a zero-day in 2025; it affects WinRAR through 7.12 and is fixed in 7.13. It is in CISA's Known Exploited Vulnerabilities catalog.

Talos says this is the first time it has seen UAT-6275 use a vulnerability in its delivery chain. In the April 2026 chain, a malicious RAR archive exploits CVE-2025-8088 to drop a reverse shell Talos calls PickleShell into the Windows Startup folder, so it executes at the victim's next sign-in.

The campaign

• Timeframe: activity observed from June 2025 through August 2026, across four distinct infection chains (macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and the WinRAR archive).
• Targets: government organizations across the CIS, with specific interest in water, environmental, and energy bodies. One lure reportedly posed as a Russian diplomatic letter aimed at Armenia's foreign ministry.
• Tooling: custom reverse shells Talos names FoalShell, Chvost, Laplas, and PickleShell.
• Tradecraft: operational-security lapses — public staging directories and an exposed GitHub repository — leaked payloads and tooling to the researchers.

Attribution — hedged

Talos assesses a Kazakhstan nexus with medium confidence, and is explicit that this is an assessment, not confirmed attribution. The indicators it cites are Russian-language artifacts, apparent malware-testing submissions originating from Kazakhstan, and working-hours analysis. Naming diverges across vendors — Talos uses UAT-6275, Recorded Future uses TAG-193, and third-party reporting applies the Silent Lynx label — so treat cross-report mapping as approximate.

What to do

1. Upgrade WinRAR to 7.13 or later on every Windows endpoint. WinRAR has no auto-update mechanism; older installs persist until someone replaces them by hand, which is exactly the gap this campaign exploits.
2. Audit the per-user Startup folder (%AppData%\Microsoft\Windows\Start Menu\Programs\Startup) for unexpected executables or scripts — the CVE-2025-8088 technique plants persistence there.
3. Pull Talos's published IOCs (hashes, domains, and the GitHub staging infrastructure are in the report) and run them against endpoint and network telemetry.
4. Flag inbound RAR attachments for extraction in a controlled environment, and alert on archive tools writing to Startup paths.

Context

CVE-2025-8088 is the same WinRAR path-traversal bug RomCom used as a zero-day in targeted phishing in 2025. It is now being reused by a second espionage actor more than a year after a patch shipped — the recurring story of archive-tool bugs is not the disclosure but the long tail of unpatched desktops they live on. A patched flaw with no silent-update path is, for an attacker who only needs one unpatched analyst, nearly as good as a fresh one.