DEV Community

Anoymask
Anoymask

Posted on

UAT-6275 and TAG-193: Four Phishing Chains and Custom Reverse Shells Targeting Government Organizations

#security #threatintel

1. Basic Information

This is an ongoing espionage campaign targeting government, diplomatic, water, and energy organizations across nine countries. Because GitHub is used for payload distribution, monitoring is required not only for email attachments but also for external PowerShell retrieval and startup persistence following archive extraction.

2. Executive Summary

UAT-6275 (TAG-193) targets government agencies in CIS countries, gaining initial access through four distinct chains: macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives exploiting CVE-2025-8088. The group deploys reverse shells such as Chvost, Laplas, and PickleShell.

3. Attack Flow

The following four alternative paths involve different conditions and do not necessarily execute in a continuous sequence.

Path Initial Vector & User Interaction Retrieved or Placed Artifacts Subsequent Payload & Confirmation Scope
Attack Path A Open a macro-enabled Word document and enable macros Retrieve an executable from the delivery server Subsequent binary for the representative sample was not recovered; reverse shell deployment is researcher inference
Attack Path B Run a PS2EXE-generated executable contained within a RAR archive Retrieve a VBScript/script or ZIP, and create a scheduled task Deploy a PowerShell reverse shell or Chvost (depending on the sample)
Attack Path C Open an LNK file inside a RAR archive PowerShell retrieves and executes a script from GitHub Operates directly as a TCP reverse shell or places PickleShell in the Startup folder
Attack Path D Extract a crafted RAR archive using a vulnerable Windows version of WinRAR Write directly to the user's Startup folder via CVE-2025-8088 Place PickleShell (placement and subsequent execution at logon or similar events are separate stages)

Attack Path A: Macro-Enabled Word Document

  1. The user opens the document and enables macros, triggering AutoOpen.
  2. The macro retrieves an executable from the delivery server and launches it in a hidden window. The subsequent binary for the representative sample was not recovered, and the deployment of a reverse shell remains researcher inference.

Attack Path B: PS2EXE Downloader

  1. The user executes a PS2EXE-generated executable included in the phishing RAR archive.
  2. Depending on the sample, it retrieves a VBScript and PowerShell reverse shell, or a ZIP containing Chvost, and maintains execution via a scheduled task.

Attack Path C: PowerShell Hosted on GitHub

  1. Opening the LNK file inside the RAR archive launches PowerShell, which retrieves and executes a script from GitHub.
  2. Depending on the sample, it acts directly as a TCP reverse shell or as a launcher that places PickleShell into the Startup folder. In this context, GitHub serves as the script and payload distribution source.

Attack Path D: WinRAR Archive Exploiting CVE-2025-8088

  1. The user extracts a crafted RAR archive using a vulnerable Windows version of WinRAR.
  2. Path traversal via NTFS alternate data streams writes PickleShell directly into the user's Startup folder. Verify placement and subsequent execution at user sign-in as separate stages. Administrative privileges are not a prerequisite for this placement.

4. Attacker Location and Execution Context

  • A regional espionage actor operating phishing infrastructure, GitHub repositories, staging directories, and C2 servers.

5. Victim and Administrator Perspective

Victims and Users

  • Received as email attachments disguised as legitimate documents related to government, diplomacy, trade, and energy.

Administrators

  • Inference: Depending on the specific path, indicators of compromise may include executable retrieval from Office, PS2EXE execution with scheduled tasks, LNK leading to PowerShell and GitHub, or WinRAR writing to the Startup folder. Not all paths involve PowerShell launching directly from Office or WinRAR.

6. Success and Failure Conditions

Success Conditions

  • For Path A, opening the document and enabling macros; for Paths B and C, executing the executable or LNK file.
  • For Path D, extracting the archive using a Windows version of WinRAR vulnerable to CVE-2025-8088, followed by successful payload execution after placement in the Startup folder.
  • Successful network reachability to the path-specific delivery source and C2. PowerShell, GitHub, and macros are not prerequisites common to all paths.

Failure Conditions and Mitigations

  • Restrict Office macros and archives originating from the internet, and update WinRAR to a patched version.
  • Monitor GitHub raw downloads within the context of executing processes and block outbound egress traffic for reverse shells.

7. What Happens Upon Success

  • Exfiltration of government, diplomatic, water, and energy data (espionage), remote command execution, and deployment of additional tools.
  • Indications of preparation for expansion to Linux hosts or public appliances, though actual compromise remains unconfirmed.

8. Observable Logs

The following items are candidates for internal investigation. Feasibility depends on products, permissions, log settings, and retention periods; the absence of records does not prove an absence of compromise.

  • Email: Inference: Delivery from legitimate accounts of compromised government organizations has been reported. Do not rely solely on sender display names or domains to determine legitimacy; cross-reference attachments and authentication records.
  • Proxy / SWG / DNS: Inference: Identify PowerShell communications to GitHub raw or staging directories, as well as C2 destinations.
  • Endpoint / EDR: Inference: Separately verify indicators such as document-based retrieval and execution for Path A, PS2EXE and scheduled tasks for Path B, LNK-to-PowerShell for Path C, and WinRAR writes outside the selected extraction directory (into the Startup folder) as well as subsequent execution as distinct stages for Path D.
  • Identity / IdP: Inference: Check for new VPN, mailbox, or cloud account sessions originating from the compromised host.
  • SaaS / Cloud: Inference: Review downloads from GitHub, cloud storage access, and access to government portals.
  • Network: Inference: Identify periodic or interactive communication associated with Chvost, Laplas, or PickleShell, along with new C2 connections.

9. Determining Attack Success

Confirmed in Public Information

  • Information Theft or Session Compromise Confirmed: Public Information: The joint paper reports the compromise of two Armenian government entities and the transmission of information to attack infrastructure. However, it does not link specific lure documents or the use of CVE-2025-8088 directly to the establishment of those compromises. Scope: Cases involving Armenian government entities reported in the joint paper. This does not imply success across all nine countries or all attack paths.

Separate contact, execution, persistence, data acquisition, and external transmission; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Initiate investigation using IOCs related to lure documents, CVE-2025-8088, GitHub PowerShell, and reverse shells.
  • Initial Verification: Check emails, attachment hashes, executing user accounts, WinRAR versions, GitHub URLs, and process trees.
  • Endpoint / Server Investigation: Preserve documents, archives, PowerShell scripts, Startup folders, and reverse shell binaries.
  • Authentication / Cloud Investigation: Review email, VPN, cloud, and government portal sessions starting from the estimated time of compromise.
  • Subsequent Actions: Trace credential access, document collection, deployment of additional tools, and access to Linux or appliance systems.
  • Containment: Isolate hosts, block C2 communication, rotate credentials, and block macro and archive vectors.
  • Judgment Categories: Separate delivery, user execution, vulnerability exploitation, payload retrieval, reverse shells, and data access.

11. Defense and Detection Ideas

  • Single Events: Inference: Detect suspicious Office-based retrieval and execution, PS2EXE with new tasks, PowerShell launched from LNK files, and WinRAR writes outside the selected extraction directory across the respective paths.
  • Temporal Correlation: Inference: For Path C, correlate LNK execution, PowerShell launch, GitHub retrieval, and reverse shell deployment; for Path D, correlate archive extraction, Startup placement, and subsequent execution at logon.
  • Threat Hunting: Search for PowerShell processes downloading from GitHub raw, PS2EXE artifacts, and IOCs associated with Chvost, Laplas, or PickleShell.
  • Log Limitations: Because cloud communications to GitHub blend with legitimate traffic, cross-referencing URLs, processes, and file hashes is necessary.
  • Priority Mitigations: Prioritize WinRAR patches, macro controls, monitoring of outbound communications to GitHub, and PowerShell logging.

12. Facts, Inference, and Hypothesis

Facts

  • Talos identified four infection chains active from June 2025 to August 2026.
  • The chains utilize macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
  • Payloads include custom reverse shells such as Chvost, Laplas, and PickleShell, providing interactive remote access.
  • Targets and lure documents span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
  • Targeted entities include government organizations related to diplomacy, economics, agriculture, environment, water resources, and energy.
  • Three publicly exposed staging directories and GitHub repository histories exposed payload builds, tools, and C2 modifications.
  • Talos assesses the activity as having a Kazakhstan nexus with medium confidence, based on infrastructure access, language, sample submissions, operating hours, and targeted regions.
  • The joint paper notes that the subsequent binary for the representative sample in Path A could not be recovered, classifying its reverse shell deployment as an inference.

Inference

  • The report does not indicate direct targeting of Japanese organizations, although organizations or business partners with operations related to Central Asian government, energy, and water sectors may intersect with the context of the lure documents.

Hypothesis

No additional hypotheses. Unconfirmed items are documented under Open Questions and Further Investigation.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1566.001 Phishing: Spearphishing Attachment high Sends macro-enabled documents and crafted archives to government organizations. Source
T1203 Exploitation for Client Execution high Utilizes WinRAR archives exploiting CVE-2025-8088. Source
T1059.001 Command and Scripting Interpreter: PowerShell high Utilizes PowerShell hosted on GitHub and PS2EXE chains. Source
T1105 Ingress Tool Transfer high Retrieves scripts and payloads from GitHub or delivery servers. Serving as a distribution source alone is not considered sufficient basis for attributing unidirectional C2. Source

Script and payload retrieval from GitHub is mapped to T1105. The reviewed sources establish script and payload delivery from GitHub, but do not establish its use for one-way C2 instructions. Therefore, T1102.003 is not assigned.

14. Open Questions and Further Investigation

  • Connections to the Kazakh government, specific numbers of victim organizations, total successful compromise counts, and the operational deployment of Linux or FortiWeb tools remain unconfirmed.
  • The subsequent binary retrieved by the representative sample in Path A and the specific initial access vectors used in individual compromise incidents remain unverified.

15. Impact on SOCs and Organizations

Communications to trusted platforms such as GitHub and the extraction of legitimate archives do not guarantee the safety of subsequent code. Organizations involved in Central Asian government and resource-related operations should evaluate macros, executables/LNK files, and WinRAR exploitation as distinct vectors, correlating retrieval sources, executing processes, and persistence mechanisms. Attribution is assessed at medium confidence, and definitive conclusions regarding state sponsorship are avoided.

16. Audience-Specific Summary

  • For SOCs: Separate the four paths and verify macro execution, PS2EXE activity, LNK-to-PowerShell execution, and WinRAR writes outside the selected extraction directory, tying each to execution and C2 evidence.
  • For Administrators: Restrict Office macros, WinRAR usage, PowerShell, and GitHub raw access to the minimum necessary, and apply patches for CVE-2025-8088.
  • For Users: Verify documents disguised as diplomatic, energy, or water communications through alternative channels, and avoid opening unverified macros or archives.

Top comments (0)