UAT-6275 used a crafted WinRAR archive to place its PickleShell reverse shell in a Windows user’s Startup folder. The payload runs at the next sign-in. That April 2026 attack was one of four delivery routes Cisco Talos and Recorded Future’s joint investigation traced across government targets in the Commonwealth of Independent States (CIS), alongside malicious Word documents, executable downloaders and shortcuts.
The investigation covers activity from June 2025 through August 2026. Its reviewed campaigns include observed victims and lure themes in nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Ministries dealing with diplomacy, economic development and environmental management are particularly relevant; the recovered lures also point toward water and energy interests. If those subjects arrive as documents or archives in your environment, the first useful question is what the recipient’s machine ran after opening them.
Four routes to remote access
Talos grouped recovered samples by how they retrieved and executed a payload. Each route leaves different execution or persistence evidence:
- Chain A, June 2025: Macro-enabled Word documents downloaded and ran a second-stage binary. Review Office child processes and the resulting download and execution events for matching lures.
- Chain B, July 2025: Downloaders built with PS2EXE, which packages PowerShell as an executable, retrieved reverse-shell payloads and created scheduled tasks. Pair a new task with its creating process and outbound connection.
- Chain C, October 2025: A malicious shortcut launched PowerShell to retrieve and execute a GitHub-hosted script for remote shell access. Later samples also downloaded PickleShell to the Startup folder. GitHub is a legitimate shared service here; the suspicious sequence is the shortcut, PowerShell retrieval and subsequent persistence.
- Chain D, April 2026: A crafted RAR archive exploited
CVE-2025-8088to place PickleShell in the Startup folder, where the next user sign-in starts it. Inspect archive extraction followed by a new Startup entry and the process at the next logon.
Talos calls Chain D “the first vulnerability exploit we observed in UAT-6275’s malware delivery.” The CVE Program record attributes the WinRAR path-traversal finding to ESET researchers Anton Cherepanov, Peter Košinár and Peter Strýček, and lists Windows WinRAR through 7.12 as affected. The archive can direct an extracted file to a path chosen by the attacker. RARLAB’s release history says 7.13 fixed this directory-traversal issue, which differs from the issue repaired in 7.12. The vendor also names Windows RAR, UnRAR, portable UnRAR source and UnRAR.dll in the affected extraction family; its Unix versions and RAR for Android fall outside that release-note scope.
Exposed staging mapped the campaign
Three publicly accessible staging directories and the history of an attacker-used GitHub repository let the researchers follow payload builds and command-and-control changes. The recovered reverse shells include Chvost, Laplas and PickleShell, all intended to give an operator interactive access. Talos describes a lure dressed as a diplomatic letter to Armenia’s foreign ministry and an energy proposal involving Turkmennebit and Russia’s Orsk Oil Refinery. Those are concrete themes to bring to mail and endpoint triage, especially where a recipient later ran a script or opened an archive.
Talos and Recorded Future track this activity as UAT-6275 and TAG-193 respectively. Talos assesses a Kazakhstan nexus with medium confidence, drawing on language artifacts, apparent malware-testing submissions, working-hour analysis and regional interests. It says the wider activity likely belongs near YoroTrooper but keeps the clusters separate. Recovered Linux-compatible tools and a FortiWeb CVE-2025-25257 proof of concept indicate preparation for other systems; the demonstrated delivery chains in this investigation run through Windows endpoints.
Match execution before patching
Start with the systems that processed the relevant government or resource-themed messages and archives. Search endpoint telemetry for a shortcut spawning PowerShell and downloading from GitHub, PS2EXE-style executable launches that create scheduled tasks, and a new Startup-folder file following RAR extraction. Compare the next sign-in’s process tree and network connections with the file’s creation time. These are behavior correlations, since an ordinary GitHub connection by itself is common and an endpoint without retained logon history leaves that sequence harder to reconstruct.
Talos lists ClamAV coverage for Win.Backdoor.PickleShell-10060602-0, Win.Backdoor.Chvost-10060603-0, Win.Malware.Generic-10060604-0, Win.Malware.LAPLAS-10060605-0, Win.Malware.LAPLAS-10060606-0 and Win.Proxy.Generic-10060628-0. Its Snort 2 rules are 1:11192, 1:15306, 1:46983 and 1:47398; Snort 3 rules are 1:46983 and 4:16. Confirm that the applicable signatures are enabled and current, and use a hit to pivot into host process, task and Startup evidence.
Remove the archive entry route
Update Windows WinRAR deployments at 7.12 or earlier to 7.13 or later, and verify the installed version on machines that handle external archives. Check bundled Windows UnRAR components against their vendor’s updated release as well. Then review the scoped Startup entries and scheduled tasks alongside PowerShell and process history; isolate and investigate endpoints with a matched reverse-shell execution trail. A patch prevents this archive placement route on updated software, while a scheduled task or Startup entry created before the update still needs incident response. If an unexpected shell ran, preserve its host and connection records before rebuilding access.