kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

UAT-6275

also tracked as silent lynx 1, yorotrooper 1

1 story · 1 in the wild · October 16, 2026 – October 16, 2026

evidence: 1 observed

how they got in

  • phishing email 1 · Oct 16

sectors

  • energy 1 · Oct 16
  • government 1 · Oct 16

geography

  • kazakhstan 1 · Oct 16

malware and tools

  • chvost 1 · Oct 16
  • foalshell 1 · Oct 16
  • laplas 1 · Oct 16
  • pickleshell 1 · Oct 16

techniques

  • exploitation 1 · Oct 16
  • macro 1 · Oct 16
  • powershell 1 · Oct 16

attack phases seen

  • Execution 1 · Oct 16
  • Initial access 1 · Oct 16

what we reported, newest first, grouped by story

October 16, 2026

  • A Kazakhstan-nexus cluster used four delivery chains against government and energy targets across nine CIS countries. Activity tracked as UAT-6275/TAG-193, with assessed overlap with Silent Lynx/YoroTrooper, ran from June 2025 through August 2026. Chains used macro documents, PS2EXE-packaged PowerShell, GitHub-hosted scripts and crafted WinRAR archives exploiting CVE-2025-8088, ultimately deploying FoalShell, Chvost, Laplas or PickleShell. Researchers found no direct indicator or tool overlap proving UAT-6275 and YoroTrooper are identical; the umbrella attribution remains an assessment. The Hacker News has the analysis, and Cisco published campaign indicators. · Oct 16 · observed · via phishing email · as silent lynx, yorotrooper · Threat Activity & Espionage