UAT-6275 Turns an Old WinRAR Bug Into Quiet Persistence on CIS Government Networks

A threat cluster tracked as UAT-6275 has been using a known WinRAR path traversal flaw, CVE-2025-8088, to drop a custom backdoor straight into the Windows Startup folder of government users across the Commonwealth of Independent States (CIS). Nobody has to run anything twice: the implant simply starts the next time the victim logs in.

The research comes from Cisco Talos working with Recorded Future's Insikt Group (which tracks the same activity as TAG-193), in a joint report published on 14 October 2026.

What happened

• The entry point is an archive. Targets receive a RAR file with two harmless-looking PDF decoys. Hidden alongside them are entries that use NTFS alternate data streams and relative paths to escape the extraction folder.
• The bug does the rest. CVE-2025-8088 lets a crafted archive write files outside the folder the user chose. Here, the archive carried ten hidden stream names with different numbers of ..\ steps, so at least one would land in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ regardless of where the user extracted it. No admin rights are needed.
• The payload is PickleShell, a C#/.NET reverse shell that disguises itself as a Windows service component, opens a hidden command shell and relays input and output to its control server. Newer builds encrypt that traffic. Researchers found a stable metadata GUID across nine samples, which gives hunters a useful pivot even when file names change.
• WinRAR is the newest tool, not the only one. Researchers saw the WinRAR technique added in April 2026. Activity reviewed from June 2025 to August 2026 also included macro-laced Word documents, PS2EXE-packed PowerShell downloaders that create scheduled tasks, and malicious LNK shortcuts that pull PowerShell scripts from GitHub. Other custom shells in the toolkit are named Chvost and Laplas.

Who is being targeted

Lures and victims cover Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus, with themes in diplomacy, economic planning, agriculture, environmental management and energy. One decoy imitates a Russian regional government's congratulatory letter to Armenia's foreign ministry.

On attribution: Talos links the operators to Kazakhstan with medium confidence, based on language artefacts, test submissions, infrastructure access and working hours consistent with UTC+5. The researchers say explicitly that this does not establish state sponsorship. They track UAT-6275 separately from YoroTrooper because they found no direct overlap in indicators or tooling, though they note similarities with earlier Silent Lynx phishing. Investigators also recovered a public FortiWeb exploit on actor infrastructure, but did not confirm the group had used it in the wild.

Why it matters

The vulnerability itself is not new. What makes this campaign effective is the ordinary workflow it abuses: someone opens an attachment, extracts it, and carries on working. Any organisation still running an unpatched WinRAR on its desktops is exposed to the same trick, whatever region it is in. The campaign also leans on GitHub for staging, which is a reminder that a download from a well-known platform is not automatically safe.

What to do

1. Patch WinRAR now. Update to 7.13 or later on every endpoint. WinRAR does not update itself, so check your software inventory for old copies, including portable installs.
2. Watch the Startup folder. Alert on new executables written to user Startup paths, especially when an archive tool is the process writing them.
3. Link the events together. Connect archive extraction, file creation, process launch and outbound connections when you triage. Deleting the original RAR does not remove a payload that has already been written to Startup.
4. Hunt for scheduled tasks and PowerShell. Look for unexpected tasks named like WindowsUpdate or MicrosoftOfficeUpdate, and for PowerShell fetching scripts from GitHub or other code hosts.
5. Use the published detections. Talos has released ClamAV signatures and Snort rules, and the joint paper includes file hashes and network indicators for sweeping endpoint telemetry and retained logs.
6. Brief at-risk staff. Teams in diplomacy, energy and economic planning should treat unexpected archive attachments as suspicious, even when they look official.

Original research: Cisco Talos and Recorded Future Insikt Group. Initially reported by Cyber Security News.