UnclassifiedUnknown
UAT-6275
UAT-6275 is a threat actor group, tracked by Brandefense. It targets the Finance sector. It exploits 1 known CVE.
Also known as
- TAG-193
- Silent Lynx
- Techniques
- 0
- Exploited CVEs
- 1
- First seen
- Jun 1, 2025
- Last seen
- Aug 31, 2026
- Record updated
Who They Target.
Sectors · 1
Vulnerabilities They Exploit.
Browse Vulnerability Intelligence →Campaigns.
- UAT-6275 (Silent Lynx) CIS Government Espionage Campaign 2025-2026Jun 2025 to Aug 2026
About UAT-6275.
The cluster spearphishes from compromised government accounts and delivers reverse shells (PickleShell, Chvost, Laplas) through macro documents, PS2EXE downloaders, LNK files in RAR archives running GitHub-hosted PowerShell and, from April 2026, RAR archives exploiting WinRAR CVE-2025-8088.
Last updated Nov 4, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.