{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "UAT-6275 targets critical regional government sectors using custom shells; a negative result confirms no foothold exists across the monitored estate." }, "name": "UAT-6275 Endpoint Infection and Persistence Lifecycle", "type": "investigation", "labels": [ "hunt", "attack.t1053.005", "attack.t1059.001", "attack.t1190", "attack.t1204.002", "attack.t1547.001", "command and control", "execution", "initial access", "persistence" ], "series": { "slug": "break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations", "index": 1, "title": "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations", "total": 2 }, "related": [ { "hunt": "vulnerability-targeting-edge-appliances", "reason": "UAT-6275 also targets FortiWeb appliances (CVE-2025-25257); that requires cloud control-plane logs and is a sibling hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "Individual rules might flag encoded PowerShell, but this hunt connects the vulnerable state to the specific GitHub-delivery script blocks and correlates them with rare outbound beaconing from the resulting processes.", "coverage": [ { "stage": "initial-access-lures-and-winrar-exploit", "steps": [ "vulnerability-scoping", "github-script-execution", "github-dns-traffic" ], "status": "covered" }, { "stage": "execution-powershell-payload-retrieval", "steps": [ "github-script-execution", "github-dns-traffic" ], "status": "covered" }, { "stage": "persistence-via-tasks-and-startup", "steps": [ "persistence-mechanisms" ], "status": "covered" }, { "stage": "c2-reverse-shell-deployment", "steps": [ "rare-outbound-c2" ], "status": "covered" }, { "stage": "vulnerability-targeting-edge-appliances", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Malicious Lures and WinRAR Exploitation", "slug": "initial-access-lures-and-winrar-exploit", "tactic": "initial-access", "techniques": [ "T1204.002", "T1190" ], "observables": [ "CVE-2025-8088", ".rar archive", ".doc (macro-enabled)", ".lnk (shortcut file)" ] }, { "name": "PowerShell and PS2EXE Execution", "slug": "execution-powershell-payload-retrieval", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "powershell.exe", "raw.githubusercontent.com", "PS2EXE compiled executables", "GitHub-hosted scripts" ] }, { "name": "Scheduled Task and Startup Persistence", "slug": "persistence-via-tasks-and-startup", "tactic": "persistence", "techniques": [ "T1053.005", "T1547.001" ], "observables": [ "schtasks.exe", "PickleShell", "Windows Startup folder", "%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ] }, { "name": "Interactive Command and Control", "slug": "c2-reverse-shell-deployment", "tactic": "command-and-control", "techniques": [ "T1059" ], "observables": [ "PickleShell", "Chvost", "Laplas", "custom reverse shells" ] }, { "name": "Internet-Facing Appliance Targeting", "slug": "vulnerability-targeting-edge-appliances", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2025-25257", "FortiWeb SQL Injection PoC", "Linux-compatible reverse shell tools" ] } ], "summary": "UAT-6275 (also known as TAG-193) targets government entities in the CIS region using diverse infection vectors including macro-enabled documents, PowerShell downloaders, and a WinRAR path traversal exploit (CVE-2025-8088). The campaign deploys custom reverse shells such as PickleShell, Chvost, and Laplas, securing long-term access through Scheduled Tasks and Windows Startup folder persistence." }, "severity": "high", "rationale": "Focus scoping on workstation systems where users frequently handle archive files or documents. Prioritize sectors mentioned in the report like government, resource management, and energy.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established a foothold using WinRAR path traversal or macro-enabled documents to execute GitHub-hosted PowerShell scripts and persist via custom reverse shells.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to narrow the search; if empty, the whole estate is searched." }, "target_cves": { "from": { "ref": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "kind": "article", "observed": "2026-10-14" }, "type": "list[string]", "default": [ "CVE-2025-8088" ], "description": "CVE IDs associated with the WinRAR path traversal vulnerability used in delivery." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "malware_names": { "from": { "ref": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "kind": "article", "observed": "2026-10-14" }, "type": "list[string]", "default": [ "pickleshell", "chvost", "laplas" ], "description": "Names of the custom reverse shell families observed in the campaign." }, "github_domains": { "from": { "ref": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "kind": "article", "observed": "2026-10-14" }, "type": "list[domain]", "default": [ "github.com", "raw.githubusercontent.com" ], "description": "Domains used by the actor to host second-stage payloads." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/", "name": "Talos \u2014 Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations" } ], "blind_spots": [ { "id": "no-endpoint-telemetry", "risk": "Beachheads on unmanaged systems remain invisible to this hunt.", "stage": "initial-access-lures-and-winrar-exploit", "question": "whether unmanaged assets are infected via the WinRAR vulnerability", "requires": "agent coverage on all target hosts" }, { "id": "script-block-truncation", "risk": "Highly obfuscated scripts might be truncated, making it difficult for the agent to identify the GitHub URL.", "stage": "execution-powershell-payload-retrieval", "question": "the exact content of very large obfuscated scripts", "requires": "full script block logging" } ] }, "name": "UAT-6275 Endpoint Infection and Persistence Lifecycle", "description": "This hunt examines the workstation infection lifecycle of the UAT-6275 (Silent Lynx) cluster. It begins by identifying hosts vulnerable to the WinRAR CVE-2025-8088 exploit, then searches for evidence of PowerShell payload retrieval from GitHub. The second phase pivots to look for persistence mechanisms\u2014specifically scheduled tasks referencing custom malware families\u2014and corroborates this with rare outbound network connections indicative of reverse shell C2." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations", "index": 1, "title": "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations", "total": 2 }, "coverage": [ { "stage": "initial-access-lures-and-winrar-exploit", "steps": [ "vulnerability-scoping", "github-script-execution", "github-dns-traffic" ], "status": "covered" }, { "stage": "execution-powershell-payload-retrieval", "steps": [ "github-script-execution", "github-dns-traffic" ], "status": "covered" }, { "stage": "persistence-via-tasks-and-startup", "steps": [ "persistence-mechanisms" ], "status": "covered" }, { "stage": "c2-reverse-shell-deployment", "steps": [ "rare-outbound-c2" ], "status": "covered" }, { "stage": "vulnerability-targeting-edge-appliances", "reason": "Belongs to another part of the 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established a foothold using WinRAR path traversal or macro-enabled documents to execute GitHub-hosted PowerShell scripts and persist via custom reverse shells.", "blind_spots": [ { "id": "no-endpoint-telemetry", "risk": "Beachheads on unmanaged systems remain invisible to this hunt.", "stage": "initial-access-lures-and-winrar-exploit", "question": "whether unmanaged assets are infected via the WinRAR vulnerability", "requires": "agent coverage on all target hosts" }, { "id": "script-block-truncation", "risk": "Highly obfuscated scripts might be truncated, making it difficult for the agent to identify the GitHub URL.", "stage": "execution-powershell-payload-retrieval", "question": "the exact content of very large obfuscated scripts", "requires": "full script block logging" } ], "scoping_notes": "Focus scoping on workstation systems where users frequently handle archive files or documents. Prioritize sectors mentioned in the report like government, resource management, and energy.", "beyond_detection": "Individual rules might flag encoded PowerShell, but this hunt connects the vulnerable state to the specific GitHub-delivery script blocks and correlates them with rare outbound beaconing from the resulting processes." } }, { "id": "vulnerability-scoping", "type": "query", "label": "Scope vulnerable WinRAR installations", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_uid, cve_uid FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0", "surface": "hb_vulnerability_finding", "description": "Identify hosts with the CVE-2025-8088 vulnerability to focus the hunt on potential targets for the Chain D infection.", "expected_signal": "A list of device UIDs that are missing the patch for the critical WinRAR vulnerability. Silence means no vulnerable systems are recorded in the current inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope vulnerable WinRAR installations", "reads": [ "device_uid", "cve_uid" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT device_uid, cve_uid FROM hb_vulnerability_finding WHERE instr(',' || '{{target_cves}}' || ',', ',' || cve_uid || ',') > 0", "silence": "not_evidence_of_absence", "expected": "A list of device UIDs that are missing the patch for the critical WinRAR vulnerability. Silence means no vulnerable systems are recorded in the current inventory.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "github-script-execution", "type": "query", "label": "GitHub-linked script blocks", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%github.com%' OR LOWER(script_content) LIKE '%raw.githubusercontent%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Identify PowerShell script execution that references GitHub hosting, matching the Chain C delivery method.", "expected_signal": "Script blocks that attempt to download or execute code directly from GitHub. Silence indicates no such script activity was logged in the window." }, "parents": [ { "id": "vulnerability-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "GitHub-linked script blocks", "reads": [ "device_hostname", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%github.com%' OR LOWER(script_content) LIKE '%raw.githubusercontent%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script blocks that attempt to download or execute code directly from GitHub. Silence indicates no such script activity was logged in the window.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "github-dns-traffic", "type": "query", "label": "GitHub DNS traffic", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, time FROM hb_dns_activity WHERE instr(',' || '{{github_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Corroborate script activity by finding DNS lookups to the report's payload domains.", "expected_signal": "A host resolving GitHub infrastructure for payload retrieval. Silence means no such resolutions occurred during the lookback period." }, "parents": [ { "id": "vulnerability-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "GitHub DNS traffic", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, time FROM hb_dns_activity WHERE instr(',' || '{{github_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A host resolving GitHub infrastructure for payload retrieval. Silence means no such resolutions occurred during the lookback period.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "delivery-agent", "type": "analytic", "label": "Triage delivery evidence", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "vulnerability-scoping", "github-script-execution", "github-dns-traffic" ], "objective": "Identify hosts showing evidence of script-based delivery targeting a WinRAR vulnerability.", "description": "Evaluate the scoping and early-stage signals to identify hosts likely targeted in the delivery phase.", "max_iterations": 4, "expected_signal": "A list of suspicious hosts with cited delivery indicators.", "success_criteria": "A verdict of malicious or suspicious for hosts matching both the vulnerability scope and GitHub script activity." }, "parents": [ { "id": "github-script-execution", "kind": "merge" }, { "id": "github-dns-traffic", "kind": "merge" } ] }, { "id": "persistence-mechanisms", "type": "query", "label": "Persistence via scheduled jobs", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, time FROM hb_scheduled_job WHERE (instr(',' || '{{malware_names}}' || ',', ',' || LOWER(job_name) || ',') > 0 OR LOWER(job_cmd_line) LIKE '%pickleshell%' OR LOWER(job_cmd_line) LIKE '%chvost%' OR LOWER(job_cmd_line) LIKE '%laplas%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_scheduled_job", "description": "Search for scheduled tasks that reference the specific malware families used by UAT-6275.", "expected_signal": "A task configured to run one of the reported reverse shells. Silence means no matching tasks exist on the current fleet." }, "parents": [ { "id": "delivery-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Persistence via scheduled jobs", "reads": [ "device_hostname", "job_name", "job_cmd_line", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, time FROM hb_scheduled_job WHERE (instr(',' || '{{malware_names}}' || ',', ',' || LOWER(job_name) || ',') > 0 OR LOWER(job_cmd_line) LIKE '%pickleshell%' OR LOWER(job_cmd_line) LIKE '%chvost%' OR LOWER(job_cmd_line) LIKE '%laplas%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A task configured to run one of the reported reverse shells. Silence means no matching tasks exist on the current fleet.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "rare-outbound-c2", "type": "query", "label": "Rare process outbound connections", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT process_name, device_hostname, dst_endpoint_ip, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, device_hostname, dst_endpoint_ip HAVING COUNT(DISTINCT device_hostname) <= 3 ORDER BY connection_count DESC", "surface": "hb_network_connection", "description": "Find rare processes beaconing to external IPs, characteristic of the interactive reverse shells.", "expected_signal": "A process seen on very few hosts exhibiting persistent outbound network connectivity. Silence means no rare beaconing was observed." }, "parents": [ { "id": "delivery-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare process outbound connections", "reads": [ "process_name", "device_hostname", "dst_endpoint_ip", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT process_name, device_hostname, dst_endpoint_ip, COUNT(*) as connection_count, MIN(time) as first_seen FROM hb_network_connection WHERE direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, device_hostname, dst_endpoint_ip HAVING COUNT(DISTINCT device_hostname) <= 3 ORDER BY connection_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A process seen on very few hosts exhibiting persistent outbound network connectivity. Silence means no rare beaconing was observed.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 4 }, "verified_at": "2026-10-15" } }, { "id": "intrusion-agent", "type": "analytic", "label": "Synthesize intrusion analysis", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "delivery-agent", "persistence-mechanisms", "rare-outbound-c2" ], "objective": "Synthesize delivery and follow-on persistence or C2 signals to identify a confirmed intrusion.", "description": "Combine delivery, persistence, and C2 signals to identify a confirmed intrusion chain.", "max_iterations": 4, "expected_signal": "A final per-host verdict of malicious | suspicious | benign.", "success_criteria": "A confirmed intrusion verdict citing specific rows for persistence and rare network activity." }, "parents": [ { "id": "persistence-mechanisms", "kind": "merge" }, { "id": "rare-outbound-c2", "kind": "merge" } ] }, { "id": "intrusion-decision", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the intrusion-agent verdict is malicious for at least one host", "condition": "the intrusion-agent verdict is malicious for at least one host", "blind_spot": "no-endpoint-telemetry", "confidence": "high", "description": "Determine whether to proceed with containment or further manual review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "intrusion-agent" } ] }, { "id": "containment-and-remediation", "type": "action", "label": "Containment and remediation", "config": { "target": "endpoint", "description": "Isolate the host and remove persistence to stop the intrusion.", "instructions": "Isolate the identified host(s) from the network. Remove the malicious scheduled tasks and startup items found by the agent. Extract the shell binaries for forensic analysis.", "action_approval": "required" }, "parents": [ { "id": "intrusion-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Verify the findings and document the incident context.", "instructions": "Review the cited script blocks and network connections. Confirm if the rare outbound traffic matches a reverse shell pattern. Ensure the vulnerability on the beachhead is prioritized for patching." }, "parents": [ { "id": "intrusion-decision", "branch": "default" }, { "id": "intrusion-decision", "branch": "on_unavailable" }, { "id": "containment-and-remediation" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and mark the hunt complete.", "instructions": "Record the number of vulnerable hosts identified and any confirmed infections. Recommend updating WinRAR to resolve CVE-2025-8088 estate-wide." }, "parents": [ { "id": "intrusion-decision", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }