{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Edge appliances are the primary entry points for UAT-6275. Unauthenticated SQL injection on a security appliance like FortiWeb represents a critical risk to perimeter security and facilitates further intrusion." }, "name": "UAT-6275 FortiWeb Edge Appliance Exposure", "type": "investigation", "labels": [ "hunt", "attack.t1190", "command and control", "execution", "initial access", "persistence" ], "series": { "slug": "break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations", "index": 2, "title": "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations", "total": 2 }, "related": [ { "hunt": "uat-6275-windows-persistence-and-payloads", "reason": "This hunt focuses on the appliance entry point; subsequent Windows-based persistence and PowerShell scripts are handled separately.", "relation": "out-of-scope-alternative" }, { "hunt": "uat-6275-infection-lifecycle", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This hunt correlates the static state of a vulnerability with live behavioral egress telemetry and HTTP pattern matching across multiple surfaces. This provides a contextual picture of successful exploitation that a single rule cannot provide.", "coverage": [ { "stage": "vulnerability-targeting-edge-appliances", "steps": [ "identify-vulnerable-fortiweb", "exploit-attempt-http", "reverse-shell-egress", "triage-verdict" ], "status": "covered" }, { "stage": "initial-access-lures-and-winrar-exploit", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" }, { "stage": "execution-powershell-payload-retrieval", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" }, { "stage": "persistence-via-tasks-and-startup", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" }, { "stage": "c2-reverse-shell-deployment", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Malicious Lures and WinRAR Exploitation", "slug": "initial-access-lures-and-winrar-exploit", "tactic": "initial-access", "techniques": [ "T1204.002", "T1190" ], "observables": [ "CVE-2025-8088", ".rar archive", ".doc (macro-enabled)", ".lnk (shortcut file)" ] }, { "name": "PowerShell and PS2EXE Execution", "slug": "execution-powershell-payload-retrieval", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "powershell.exe", "raw.githubusercontent.com", "PS2EXE compiled executables", "GitHub-hosted scripts" ] }, { "name": "Scheduled Task and Startup Persistence", "slug": "persistence-via-tasks-and-startup", "tactic": "persistence", "techniques": [ "T1053.005", "T1547.001" ], "observables": [ "schtasks.exe", "PickleShell", "Windows Startup folder", "%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ] }, { "name": "Interactive Command and Control", "slug": "c2-reverse-shell-deployment", "tactic": "command-and-control", "techniques": [ "T1059" ], "observables": [ "PickleShell", "Chvost", "Laplas", "custom reverse shells" ] }, { "name": "Internet-Facing Appliance Targeting", "slug": "vulnerability-targeting-edge-appliances", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2025-25257", "FortiWeb SQL Injection PoC", "Linux-compatible reverse shell tools" ] } ], "summary": "UAT-6275 (also known as TAG-193) targets government entities in the CIS region using diverse infection vectors including macro-enabled documents, PowerShell downloaders, and a WinRAR path traversal exploit (CVE-2025-8088). The campaign deploys custom reverse shells such as PickleShell, Chvost, and Laplas, securing long-term access through Scheduled Tasks and Windows Startup folder persistence." }, "severity": "high", "rationale": "Focus on systems reporting CVE-2025-25257. If the scanner is unavailable, scope to all hostnames identified as 'Fortinet' or 'FortiWeb' in the software inventory.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary targets internet-facing FortiWeb appliances using CVE-2025-25257 to achieve initial access via SQL injection, followed by the deployment of a Linux-based reverse shell.", "parameters": { "target_cve": { "from": { "ref": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "kind": "article", "observed": "2026-10-14" }, "type": "string", "default": "CVE-2025-25257", "description": "The FortiWeb SQL injection CVE ID mentioned in the research." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Specific hostnames to focus on; if empty, all hosts are examined." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "name": "Cisco Talos \u2014 Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations" } ], "blind_spots": [ { "id": "incomplete-appliance-telemetry", "risk": "Attackers can bypass detections by placing SQL injection payloads in the POST body, which is not captured in hb_http_activity.", "stage": "vulnerability-targeting-edge-appliances", "question": "whether SQL injection payloads were hidden in POST request bodies", "requires": "Full HTTP request body logging" }, { "id": "missing-endpoint-visibility", "risk": "Appliances often do not support standard EDR agents, leaving OS-level execution invisible to endpoint surfaces.", "stage": "vulnerability-targeting-edge-appliances", "question": "whether the reverse shell binary was executed on the underlying appliance OS", "requires": "hb_process_activity on the appliance OS" } ] }, "name": "UAT-6275 FortiWeb Edge Appliance Exposure", "description": "This hunt examines the organization's external attack surface for vulnerable Fortinet appliances targeted by UAT-6275. The hunt first identifies systems reporting CVE-2025-25257 and maps them to hostnames. An analyst then uses these hostnames to focus behavioral queries on incoming HTTP requests containing SQL injection patterns and anomalous outbound network connections. An agent evaluates these disparate signals to determine if a vulnerable appliance has been successfully compromised." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations", "index": 2, "title": "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations", "total": 2 }, "coverage": [ { "stage": "vulnerability-targeting-edge-appliances", "steps": [ "identify-vulnerable-fortiweb", "exploit-attempt-http", "reverse-shell-egress", "triage-verdict" ], "status": "covered" }, { "stage": "initial-access-lures-and-winrar-exploit", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" }, { "stage": "execution-powershell-payload-retrieval", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" }, { "stage": "persistence-via-tasks-and-startup", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" }, { "stage": "c2-reverse-shell-deployment", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" } ], "rationale": "An adversary targets internet-facing FortiWeb appliances using CVE-2025-25257 to achieve initial access via SQL injection, followed by the deployment of a Linux-based reverse shell.", "blind_spots": [ { "id": "incomplete-appliance-telemetry", "risk": "Attackers can bypass detections by placing SQL injection payloads in the POST body, which is not captured in hb_http_activity.", "stage": "vulnerability-targeting-edge-appliances", "question": "whether SQL injection payloads were hidden in POST request bodies", "requires": "Full HTTP request body logging" }, { "id": "missing-endpoint-visibility", "risk": "Appliances often do not support standard EDR agents, leaving OS-level execution invisible to endpoint surfaces.", "stage": "vulnerability-targeting-edge-appliances", "question": "whether the reverse shell binary was executed on the underlying appliance OS", "requires": "hb_process_activity on the appliance OS" } ], "scoping_notes": "Focus on systems reporting CVE-2025-25257. If the scanner is unavailable, scope to all hostnames identified as 'Fortinet' or 'FortiWeb' in the software inventory.", "beyond_detection": "This hunt correlates the static state of a vulnerability with live behavioral egress telemetry and HTTP pattern matching across multiple surfaces. This provides a contextual picture of successful exploitation that a single rule cannot provide." } }, { "id": "identify-vulnerable-fortiweb", "type": "query", "label": "Identify vulnerable FortiWeb appliances", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT f.resource_uid, d.hostname AS device_hostname, f.cve_uid, f.severity FROM hb_vulnerability_finding f JOIN hb_devices d ON f.device_uid = d.device_uid WHERE f.cve_uid = '{{target_cve}}' AND f.status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Find all systems currently reporting the target CVE and retrieve their hostnames for scoping.", "expected_signal": "A list of hostnames reporting the CVE. Silence proves no systems are currently flagged with this vulnerability in the scanner." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable FortiWeb appliances", "reads": [ "resource_uid", "device_uid", "cve_uid", "severity", "status" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT f.resource_uid, d.hostname AS device_hostname, f.cve_uid, f.severity FROM hb_vulnerability_finding f JOIN hb_devices d ON f.device_uid = d.device_uid WHERE f.cve_uid = '{{target_cve}}' AND f.status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of hostnames reporting the CVE. Silence proves no systems are currently flagged with this vulnerability in the scanner.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "exploit-attempt-http", "type": "query", "label": "HTTP SQL injection patterns", "config": { "dsl": "sqlite", "role": "triage", "source": "web", "content": "SELECT device_hostname, url_path, url_query, src_endpoint_ip, status_code, time FROM hb_http_activity WHERE (LOWER(url_query) LIKE '%select%' OR LOWER(url_query) LIKE '%union%' OR LOWER(url_query) LIKE '%sleep(%' OR url_query LIKE '%''%' OR url_query LIKE '%--%' OR url_query LIKE '%/*%') AND status_code IN (200, 500) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Identify inbound HTTP requests containing SQL injection markers targeting appliances in scope.", "expected_signal": "Requests with SQL keywords or non-alphanumeric markers that resulted in successful processing or server errors. Silence suggests the WAF or appliance blocked the attempts." }, "parents": [ { "id": "identify-vulnerable-fortiweb" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "HTTP SQL injection patterns", "reads": [ "device_hostname", "url_path", "url_query", "src_endpoint_ip", "status_code", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_path, url_query, src_endpoint_ip, status_code, time FROM hb_http_activity WHERE (LOWER(url_query) LIKE '%select%' OR LOWER(url_query) LIKE '%union%' OR LOWER(url_query) LIKE '%sleep(%' OR url_query LIKE '%''%' OR url_query LIKE '%--%' OR url_query LIKE '%/*%') AND status_code IN (200, 500) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Requests with SQL keywords or non-alphanumeric markers that resulted in successful processing or server errors. Silence suggests the WAF or appliance blocked the attempts.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "reverse-shell-egress", "type": "query", "label": "Reverse shell egress from appliances", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as conn_count, MIN(time) as first_seen FROM hb_network_connection WHERE direction = 'outbound' AND dst_endpoint_port NOT IN (80, 443, 53, 514, 541) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port", "surface": "hb_network_connection", "description": "Find outbound network connections from scoped appliances to non-standard ports, signaling potential reverse shell activity.", "expected_signal": "Connections to rare external IPs or high ports, excluding standard management and monitoring ports. Outbound traffic to non-standard ports is the primary indicator of a shell." }, "parents": [ { "id": "identify-vulnerable-fortiweb" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Reverse shell egress from appliances", "reads": [ "device_hostname", "dst_endpoint_ip", "dst_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, COUNT(*) as conn_count, MIN(time) as first_seen FROM hb_network_connection WHERE direction = 'outbound' AND dst_endpoint_port NOT IN (80, 443, 53, 514, 541) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Connections to rare external IPs or high ports, excluding standard management and monitoring ports. Outbound traffic to non-standard ports is the primary indicator of a shell.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_ip", "dst_endpoint_port" ], "rare_below": 3 }, "verified_at": "2026-10-15" } }, { "id": "triage-verdict", "type": "analytic", "label": "Triage appliance compromise", "config": { "cite": "required", "tools": [ "endpoint", "network", "web" ], "context": [ "identify-vulnerable-fortiweb", "exploit-attempt-http", "reverse-shell-egress" ], "objective": "Determine if a vulnerable FortiWeb appliance has been exploited based on HTTP SQLi strings and rare outbound network connections.", "description": "Evaluate if the presence of CVE-2025-25257 aligns with active exploit telemetry and anomalous network behavior.", "max_iterations": 3, "expected_signal": "A per-host verdict citing specific telemetry rows.", "success_criteria": "A verdict of malicious | suspicious | benign for each host in the scope." }, "parents": [ { "id": "exploit-attempt-http", "kind": "merge" }, { "id": "reverse-shell-egress", "kind": "merge" } ] }, { "id": "route-on-triage", "type": "checkpoint", "label": "Route on triage verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "incomplete-appliance-telemetry", "confidence": "medium", "description": "Direct the workflow based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-verdict" } ] }, { "id": "isolate-device", "type": "action", "label": "Isolate appliance", "config": { "target": "endpoint", "description": "Sever the adversary's connection to the compromised device.", "instructions": "Isolate the FortiWeb appliance at the firewall or through the management console. Revoke any associated cloud service roles.", "action_approval": "required" }, "parents": [ { "id": "route-on-triage", "branch": "on_supports" } ] }, { "id": "forensic-review", "type": "task", "label": "Forensic review", "config": { "assignee": "analyst", "description": "Verify the agent's findings and assess the extent of the intrusion.", "instructions": "Inspect native appliance logs for specific SQL injection payloads not visible in query strings. Review the file system for reverse shell binaries or modified scripts and verify the integrity of application files." }, "parents": [ { "id": "route-on-triage", "branch": "default" }, { "id": "route-on-triage", "branch": "on_unavailable" }, { "id": "route-on-triage", "branch": "on_refutes" }, { "id": "isolate-device" } ] }, { "id": "remediation-closeout", "type": "task", "label": "Remediation and closeout", "config": { "assignee": "analyst", "description": "Ensure the vulnerability is patched and findings are documented.", "instructions": "Apply security patches to FortiWeb appliances to address CVE-2025-25257. Update the vulnerability management status and archive the hunt results." }, "parents": [ { "id": "forensic-review" } ] } ] }