TAG-193 Espionage Campaigns Target Government Organizations Across Central Asia and the CIS
Summary
Research links TAG-193, also tracked as UAT-6275 and Silent Lynx, to sustained espionage targeting regional governments. It details the group’s malware, spearphishing and exploit-assisted delivery, while assessing—but not confirming—a Kazakhstan base.
Key points
- Researchers identified campaigns from early 2025 through May 2026 involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.
- The group’s targeting spans diplomacy, economic development, agriculture, environmental management, and resource-related organizations.
- TAG-193 uses spearphishing from compromised government accounts and hosts malicious scripts and payloads on trusted public services such as GitHub.
- Recovered tools include LAPLAS, FoalShell variants, and PowerShell-based reverse shells; researchers identified four infection-chain types.
- An April 2026 infection chain likely targeting Armenia’s Ministry of Foreign Affairs exploited WinRAR CVE-2025-8088 to place malware in the Windows Startup folder.
- Researchers found a FortiWeb exploit on the group’s infrastructure but did not confirm its use in attacks.
- Evidence supports a possible Kazakhstan operating base, but does not establish the group’s affiliation or state sponsorship.
Article Details
- Attack Vectors
- Spearphishing emails sent from compromised government accounts with official-looking lure documents.
- Malicious scripts and payloads hosted on GitHub.
- Exploit-assisted delivery using CVE-2025-8088 to place malware in the Windows Startup folder for execution at the user's next sign-in.
- Lightweight interactive reverse shells used to issue commands on compromised systems.
- Defensive Notes
- Protect government email accounts and monitor for their compromise or misuse.
- Monitor for malicious content hosted on trusted public services and unexpected remote-access activity.
- Prioritize protection of environmental agencies, forestry platforms, economic ministries, foreign affairs institutions, and national security organizations.
MITRE ATT&CK
T1059.001 · PowerShellTAG-193 uses PowerShell-based reverse shells to enable operators to issue commands on compromised systems.T1203 · Exploitation for Client ExecutionAn April 2026 infection chain exploited CVE-2025-8088 in WinRAR to deliver malware.T1547.001 · Registry Run Keys / Startup FolderThe CVE-2025-8088 chain placed malware in the Windows Startup folder to run at the user's next sign-in.T1566.001 · Spearphishing AttachmentTAG-193 sends spearphishing emails with official-looking lure documents from compromised government accounts.
CVE
Threat Actors
Malware
Products
FortiWebLinux-compatible tooling and a publicly available FortiWeb exploit recovered from TAG-193 infrastructure suggest that TAG-193 is interested in expanding its operational capabilities.GitHubThe group also uses public services such as GitHub to host malicious scripts and payloads.WinRARin April 2026 and likely used against Armenia’s Ministry of Foreign Affairs, this chain exploited the WinRAR vulnerability CVE-2025-8088 to place malware in the Windows Startup folder, enabling execution when the
Tools
FoalShellIts tooling includes LAPLAS, multiple FoalShell variants, and PowerShell-based reverse shells.LAPLASIts tooling includes LAPLAS, multiple FoalShell variants, and PowerShell-based reverse shells.PowerShellIts tooling includes LAPLAS, multiple FoalShell variants, and PowerShell-based reverse shells.
Countries
ArmeniaOur research examined TAG-193 campaigns from early 2025 through May 2026, identifying activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.BelarusOur research examined TAG-193 campaigns from early 2025 through May 2026, identifying activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.KazakhstanThe findings point to possible links to Kazakhstan, but questions remain about the group’s origins.RussiaOur research examined TAG-193 campaigns from early 2025 through May 2026, identifying activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.TajikistanOur research examined TAG-193 campaigns from early 2025 through May 2026, identifying activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.TurkmenistanIdentified lures included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery.UzbekistanOur research examined TAG-193 campaigns from early 2025 through May 2026, identifying activity involving government entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan.
Industries
AgricultureTAG-193’s targeting extends across government institutions responsible for diplomacy, economic development, agriculture, and environmental management.DiplomacyThis post highlights how TAG-193’s operations reflect the intelligence value of regional diplomacy and resource management, and how its expanding toolkit supports that mission.Economic developmentTAG-193’s targeting extends across government institutions responsible for diplomacy, economic development, agriculture, and environmental management.EnergyAcross Central Asia, shared river systems and interconnected energy and transport infrastructure give such information particular strategic value.Environmental managementTAG-193’s targeting extends across government institutions responsible for diplomacy, economic development, agriculture, and environmental management.ForestryTracked by Cisco Talos as UAT-6275 and also known as Silent Lynx, TAG-193 combines diplomatic and economic targeting with an interest in environmental policy, water resources, and forestry.Governmentand Recorded Future’s Insikt Group examined sustained cyber-espionage activity by TAG-193 targeting government organizations across Central Asia and the wider Commonwealth of Independent States (CIS).