LowII Cyber Warfare & Critical Infrastructure14 October 2026, Wednesday
Kazakhstan-linked hackers target water and energy files across CIS governments
Cisco Talos and Recorded Future said on 14 October that a group they assess with moderate confidence to be linked to Kazakhstan has targeted government bodies in 9 countries through at least 8 campaigns since January 2025. The stolen files point to an interest in water resources and energy.
The group, tracked as UAT-6275 by Talos and TAG-193 by Recorded Future, has been observed through victims or lure themes in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Talos bases its attribution on 3 clues: Russian-language artefacts in the code, malware uploaded for testing from Kazakhstan, and operators working office hours in UTC+5. In April 2026 the group exploited the CVE-2025-8088 flaw in WinRAR, most likely against Armenia's foreign ministry. According to The Record, this is the first time the group has exploited a software vulnerability.
Target selection tracks the diplomatic calendar. The Record says a Tajik body was hit shortly after treaty talks with Kazakhstan in March 2026, and a Belarusian body ahead of a bilateral meeting in April. Talos detected activity in May 2026 aimed at Armenia's environment agency and Uzbekistan's Smart Forestry initiative. A lure document from August 2025, written in the name of Turkmennebit, proposed cooperation with the Orsk refinery; that refinery was shut by a drone strike in August 2026. What was stolen could not be verified.
Talay assessment
Bottom line
The finding suggests that cyber espionage in Central Asia does not come only from Russia and China, and that regional states are also watching their neighbours in water and energy bargaining. Attribution remains at moderate confidence, so state responsibility is not established. The most likely path is that the group keeps targeting diplomatic and resource-management bodies, leaning more often on vulnerability exploitation.
Likely effects
- Regional water diplomacyNegative1–6 months
Activity aimed at Armenia's environment agency and Uzbekistan's forestry initiative could create information asymmetry in cross-border water and resource negotiations.
- Public-sector IT securityNegativeWeeks
The group's move to a WinRAR flaw in April 2026 shows that anti-phishing training is not enough; patching speed is decisive in CIS institutions.
- TürkiyeUncertain1–6 months
With Turkmenistan and Azerbaijan on the target list, organisations partnering in Caspian energy projects need to be alert to lure documents.
Possibilities, ranked
- 1Campaigns continue65%
The group keeps going after diplomatic and resource-management bodies with fresh lures.
Watch: New indicators published by Talos and Recorded Future for UAT-6275/TAG-193
- 2Official response20%
One of the targeted countries formally ties the activity to Kazakhstan and issues a diplomatic note.
Watch: A statement from the Armenian or Tajik foreign ministry
- 3The group goes quiet15%
Infrastructure changes after the exposure and activity disappears from view for months.
Watch: New GitHub-hosted malware samples drying up
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Targeted countries▼ 9
- Campaigns▼ at least 8