Kazakhstan-linked hackers target former Soviet governments for diplomatic and economic data

Cyber-Espionage Campaign Targets Former Soviet States

A cyber-espionage group, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future's Insikt Group, has been active since January 2025. The group has conducted at least eight campaigns targeting government agencies across Central Asia and other former Soviet states. Countries targeted or of interest include Russia, Belarus, Armenia, Uzbekistan, and Tajikistan.

Information Sought by Attackers

The hackers primarily sought information related to diplomatic affairs, economic policy, and strategic resources. Specific areas of interest included government agencies responsible for foreign affairs, economic development, agriculture, environmental management, regional energy supplies, and water resources. This information is valuable for negotiations, economic planning, and regional security decisions, especially given shared river systems and interconnected infrastructure in Central Asia.

Suspected Ties to Kazakhstan

Researchers assess with medium confidence that the hacking group has ties to Kazakhstan. Evidence supporting this assessment includes Russian-language material in the malware, indications that malicious software was tested from Kazakhstan shortly after creation, and hacking activity aligning with Kazakhstan's working hours. The group's operations also show overlap with earlier cyber-espionage campaigns attributed to YoroTrooper, another suspected Kazakhstan-based threat actor active since 2022.

Timing of Attacks

The timing of some attacks suggests an interest in diplomatic developments. For example, TAG-193 targeted a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026. Another operation targeted a Belarusian government entity before a bilateral meeting in April. While the timing indicates interest, it does not confirm what information was sought or obtained.