CyberNew CyberNew
Cyber News The Record 1 day ago

Suspected Kazakhstan-linked hackers target governments across former Soviet states

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Cyber News

Analyst Takeaway

"The Baiterek tower in Astana, Kazakhstan. Image: Paws and Prints via Unsplash Suspected Kazakhstan-linked hackers target governments across former Soviet states A cyber-espionage group with suspected ties to Kazakhstan has targeted government agencies across Central Asia and other former Soviet states, seeking information on diplomatic affairs, economic policy and strategic resources, according..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Baiterek tower, Kazakhstan
The Baiterek tower in Astana, Kazakhstan. Image: Paws and Prints via Unsplash

Suspected Kazakhstan-linked hackers target governments across former Soviet states

A cyber-espionage group with suspected ties to Kazakhstan has targeted government agencies across Central Asia and other former Soviet states, seeking information on diplomatic affairs, economic policy and strategic resources, according to new research.

The hackers, tracked as UAT-6275 by Cisco Talos and TAG-193 by , have conducted at least eight campaigns since January 2025, the two teams said in jointly issued reports. The Record is an editorially independent unit of Recorded Future.

The campaign targeted or showed interest in government institutions across nine countries, including Russia, Belarus, Armenia, Uzbekistan and Tajikistan, the researchers said.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →