October 16, 2026
- A Kazakhstan-nexus cluster used four delivery chains against government and energy targets across nine CIS countries. Activity tracked as UAT-6275/TAG-193, with assessed overlap with Silent Lynx/YoroTrooper, ran from June 2025 through August 2026. Chains used macro documents, PS2EXE-packaged PowerShell, GitHub-hosted scripts and crafted WinRAR archives exploiting CVE-2025-8088, ultimately deploying FoalShell, Chvost, Laplas or PickleShell. Researchers found no direct indicator or tool overlap proving UAT-6275 and YoroTrooper are identical; the umbrella attribution remains an assessment. The Hacker News has the analysis, and Cisco published campaign indicators. · Threat Activity & Espionage
in The Ad-Tech Pipeline Delivered Zero-Click Mercenary Spyware