UAT-6275UAT-6275

UAT-6275 is a cyberespionage actor targeting government organizations across Central Asia and the CIS, with a focus on diplomacy, economic development, and environmental management. The group employs custom RATs like Chvost, Laplas, and PickleShell, leveraging methods such as WinRAR exploits and malicious documents for payload delivery. Evidence indicates UAT-6275 has a Kazakhstan nexus, supported by Russian-language artifacts and specific operational hours. Its activity includes the creation of publicly accessible malware staging directories and interest in expanding to additional platforms, including Linux.