A threat group known as UAT-6275 has launched an operation targeting government bodies across the Commonwealth of Independent States (CIS) using a previously identified WinRAR vulnerability. This campaign exploits CVE-2025-8088—a path-traversal flaw—to run malware and maintain access on Windows machines without requiring administrator privileges. It stretches from June 2025 through August 2026 and includes newer tactics alongside older phishing and macro attacks.
How the WinRAR exploit works
The intrusion starts with a malicious RAR archive crafted to appear benign—often containing visible decoy PDFs—but hiding payloads embedded via NTFS alternate data streams. These hidden records exploit CVE-2025-8088 to drop an executable into the user’s Startup folder instead of the intended extraction path. Once the user next logs in, the payload—named PickleShell—activates, establishing remote control without triggering additional permission dialogs.
PickleShell, built in C#/.NET, masquerades as a legitimate Windows service component. It opens a concealed command shell and communicates with its controller. Some recent variants employ encrypted channels for these communications. Investigators discovered that despite different file names and wrappers, several of the samples share stable identifiers—helping security teams link related infections.
Broader toolkit and delivery methods
Although the WinRAR exploit represents a newer vector (named Chain D), UAT-6275’s operations also include macro-enabled Word documents, executable wrappers around PowerShell scripts, malicious shortcuts that launch script downloads, and scheduled tasks to maintain persistence. These techniques have been observed since mid-2025.
Some campaigns used attachments mimicking diplomatic correspondence or regional oil and energy project proposals. Targets are spread across Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. A strong regional pattern—based on language, infrastructure choice, and operating hours consistent with UTC+5—suggests possible ties to actors located in or operating through Central Asia. While these indicators don’t confirm state sponsorship, they suggest a focused, well-organized effort.
Technical details and mitigation
The malicious RAR files included multiple hidden stream names—each with different numbers of parent-directory steps—to adapt to variations in extraction paths. If successful, the executable lands in the Startup folder, avoiding administrative barriers. Additional tools uncovered include reverse shells named Chvost and Laplas.
Defenders are urged to upgrade WinRAR to version 7.13 or later where fixes for CVE-2025-8088 are applied. Other recommended measures include auditing files placed in Startup, monitoring for newly created scheduled tasks, hidden PowerShell sessions, and downloads initiated via public repositories. Simply deleting suspicious RAR attachments won’t remove payloads already embedded in Startup—which demands linking file creation, execution, and outbound traffic during incident investigations.
Signs and Indicators
Security teams have published a collection of indicators of compromise (IoCs) including SHA-256 hashes for malicious archives and payloads, exposed IP addresses hosting payloads or serving as command-and-control endpoints, and GitHub repositories used for scripts and staging. Overlaps with other regional campaigns (e.g. phishing via government-themed lures) were noted, but none yet merit unambiguous attribution with other known threat actor groups.
Companies and institutions operating in the CIS or with exposure to this region should immediately verify they are using patched WinRAR versions. Incident response should incorporate both proactive detection of the WinRAR exploit chain and retrospective log and system analysis to catch infections that may have already occurred.
Why this matters: This campaign exemplifies how legacy tools like archive software can become powerful attack pivots when overlooked in security hygiene. UAT-6275’s evolving techniques—including use of alternate data streams and fallback, multi-stage delivery paths—underscore the importance of defense-in-depth. Going forward, threat hunters should pay special attention to endpoint anomalies following archive extraction, especially from unfamiliar or decoy-laden attachments.
