N2K Networks today announced that Authorized Intelligence, the new premier podcast from Rubrik, will join the N2K CyberWire podcast network. Hosted by AI risk management expert Cal Al-Dhubaib, the podcast features conversations with leading voices across the AI ecosystem on how organizations can embrace frontier AI opportunities while navigating an increasingly complex security landscape.

Heather Ceylan, CISO at Box, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices to reflect on what security leaders have learned about enterprise AI adoption in 2026. Heather explains why trustworthy AI depends on a strong information foundation, including governed content, access controls, and auditability, and how organizations can build governance and resilience into their AI strategies from the start. She also explores how the CISO's role is shifting toward enabling responsible innovation as AI governance becomes a growing board-level priority.

Alex Weinert, Chief Product Officer at Semperis, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices conversation about how agentic AI is expanding the identity attack surface. Alex discusses the risks introduced by rapidly growing non-human identities, how AI agents can expose and exploit weaknesses in identity infrastructure, and the practical steps organizations can take to harden their environments, detect threats at machine speed, and strengthen identity resilience without sacrificing the productivity benefits of AI.

In the 1950s, Lyman Kirkpatrick had just been promoted to Chief of Operations in the CIA’s clandestine service. He was 36, with a bright future ahead. Then what he thought was a cold turned out to be polio. Suddenly, he saw his career trajectory derailed, not because of health issues but because of restrictions the agency was imposing on him for being in a wheelchair. He was determined to prove them wrong. Earning the nickname “Hell on Wheels,” Lyman ended up landing top jobs, becoming No.3 at the agency, and receiving prestigious awards for his service. To mark National Disability Employment Awareness Month in October, author David Taylor joined SpyCast host Sasha Ingber to talk about Lyman’s work and life.

• VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value.
• If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails. 
• This stealer is self-deleting, and there is no attacker-owned infrastructure. The novelty in the AI-integration is that it is not supporting a traditional malware capability but working as an intelligence analyst on behalf of the operator. 

---

There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. A new malware self-named “VOLTA-AUTODOXER,” surfaced through the CAIRN research effort, is a self-deleting Windows infostealer that augments its post-theft workflow with an LLM-powered victim-profiling stage.

After harvesting the standard stealer haul, including browser passwords; cookies; payment cards; cryptocurrency wallet seed phrases; Discord, Telegram, Steam, and Roblox sessions; Microsoft OAuth tokens; SSH and cloud-provider keys; Wi-Fi profiles; and screenshots, VOLTA builds a structured evidence bundle about the person behind the machine. This bundle contains geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. It then uses stolen session access to enrich that bundle further: searching the victim's Gmail for purchase receipts to corroborate a home address, pulling UberEats and DoorDash order history, and enriching Discord accounts via the stolen token.

The bundle is serialized and POSTed to OpenRouter under a system prompt that instructs the model to act as "a forensic intelligence analyst drafting a target assessment." The required output includes a section titled “WHAT THEY'RE WORTH” with valuables ranked by monetization with a low/medium/high tier, and a section on “THEIR OPSEC” containing an assessment of the victim's security posture and password hygiene. The model is the operator's triage analyst; it turns a raw credential log into a prioritized and citation-backed dossier of the victim and their monetizable assets.

The AI configuration: “Go deep, not wide... Be blunt, specific, accurate.” 

VOLTA uses a multi-model architecture to fall back resiliently if it hits a model’s refusal, checking each response for phrases like “I can’t” or “I’m not able,” before passing on to a chain of up to three models.

Endpoint	https[:]//openrouter[.]ai/api/v1/chat/completions
Default model	anthropic/claude-opus-4.6
Fallback chain	moonshotai/kimi-k2 → google/gemini-2.5-flash
Temperature	0.2 — deterministic, consistent output
Request format	Hand-assembled JSON; no SDK; User-Agent Mozilla/5.0

Model temperate controls the randomness and predictability of LLM-generated text. The low hardcoded temperature value (0.2) suggests the attacker is emphasizing accuracy and consistency. The malware also employs a chain of cascading models in the event of failures. This multi-model architecture suggests that the operator is anticipating encountering refusals, with the fallback pivoting to a few, smaller, and more permissive models.

The system prompt directly reveals the operator’s use case: Produce a concise analytical assessment of the victim’s suitability as a target, backed by an auditable trail of citations.

The prompt also asks for something out of the ordinary, but that agents excel at: making connections between sparse and disparate data. For example, encouraging connections like the victim’s names, addresses, or universities to patterns in their passwords. In this case, the model isn't being asked to find data; rather, it’s being asked to stretch the data and make useful inferences that extend the value of what has been scraped.

Stealer capabilities 

VOLTA’s capabilities are directly aligned with the records produced in modern digital life, and well beyond basic credential theft. In a single pass, the stealer can extract browser credentials, cookies, and saved payment cards across Chromium-based browsers. It hits Firefox and Thunderbird, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, and SSH and cloud-provider config files (gcloud, OpenVPN, Hide.me). VOLTA doesn’t just copy cryptocurrency wallets, but runs an embedded cracker against the vault inline, writing the result to a WALLET VAULTS CRACKED line in its own report.  

Every saved Wi-Fi password on the machine is pulled via a direct call to WlanGetProfileList and dumped to plaintext.

What really sets VOLTA apart from commodity stealers is what comes after the initial collection. There is a live enrichment pass that leverages stolen sessions to deep dive the victim’s data. For example, using the victim's own authenticated Gmail tokens, it queries their inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal, then review those receipts to establish a confirmed home address. Stolen Uber Eats and DoorDash sessions are called directly for order history. The Discord token is re-used to enrich the victim's account profile. Roblox inventory is valued via a live “Rolimons[.]com” lookup.

After the collection and enrichment stages are complete, the data is assembled and structured locally in a file called “Identity_Report.txt”. This file is serialized into a bundle as JSON and POSTed to OpenRouter along with the system prompt. The returned payload is received as “AI_Analysis.txt”. Both files exfil together in “volta_dox.zip”.

The inference round-trip happens entirely through the victim's own network connection, on their own machine, before the result is exfiltrated. 

Deployment model 

Instead of hardcoding its Telegram channel, API keys, and settings directly into the code (which is likely what someone writing a tool for personal use would do) VOLTA uses a template with six swappable slots, filled in at build time.  

This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order. The credentials in those slots are encrypted, but not in a meaningful way. The key is SHA-256 of two constants sitting in the same binary, but it's presumably there because customers expect their API keys not to be sitting in plaintext, not because it provides real protection. Anyone who reverses the file can recover them.  

If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.  

All the observed endpoints for this malware are third-party controlled. There is no actor-owned infrastructure.

Countermeasures 

Much of the token-stealing capability of VOLTA relies on techniques to bypass App-Bound Encryption (ABE) in Chrome. An application control policy that restricts which processes may launch Chrome with --headless would block the ABE decryption path entirely. At minimum, you can also alert when Chrome is launched with --headless from any process not in a known developer. Best practices for storing credentials in hardware backed stores also apply. 

In the event of compromise, the main executable may have deleted itself, but users should attempt to preserve the “APPDATA%\volta_debug.txt” file. This is a timestamped harvest log and contains a record of exactly what was collected and whether the LLM call succeeded. Revoke any potentially compromised tokens and change passwords. For cryptocurrency wallets, if the seed phrase was in plaintext on disk, treat the wallet as fully compromised and migrate funds to a new wallet with a seed generated on an air-gapped device. 

Conclusions 

VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work. The axis of AI improvement here is not speed or scale but effort displacement; the same logic visible in CLOSEDQUORUM, though applied to a different phase. These implants reflect the same underlying logic: Identify the step that requires the most sustained human attention and replace it with a model call. The question for defenders is not whether this pattern will appear elsewhere, but which phase it touches next.

The second trend to watch is the anticipation of hitting model refusals, and the approaches to building in resiliency. In this case, it includes a fallback chain from Claude to Kimi to Gemini and the ability to run without the LLM stage altogether if no key is present. As AI integration in malware matures, refusal resilience may become a standard design requirement. 

The open question underlying both trends is whether effort displacement in crimeware changes the landscape in a meaningful way: lowering the operational floor, raising the ceiling on scale, or both. Cybercrime operations have always been opportunistic, and the sophistication bar has always been lower than assumed, but there is a difference between a wide net and a wide net that sorts itself.  

Sample details

SHA256	57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279
Filename	9BY0tjwOc3ut.exe / yLP9m5J3i2Aw.exe
Type	PE32+ x86-64
PE Timestamp	2026-08-17 20:35
First Seen (UTC)	2026-10-11 12:46

Yonald Chery, CTO at the Technology Advancement Center (TAC), joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices. Yonald explains why securing operational technology (OT) in critical infrastructure requires specialized skills beyond traditional IT cybersecurity, particularly when protecting systems that must remain operational around the clock. He discusses how TAC is bridging the skills gap through hands-on training, simulated industrial environments, and partnerships that connect emerging technologies with national security needs.

• Cisco Talos has identified UAT-11473, a highly sophisticated advanced persistent threat (APT) actor, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems.
• UAT-11473 then installed a custom malware framework we track as “KeyDrift” consisting of multiple components geared towards collecting sensitive keying information, acting as backdoors and intermediate command-and-control (C2) hosts.
• Observed targeting spans across space and satellite services, defense and aerospace technology, and policy research.

---

Talos assesses with high confidence that UAT-11473’s operating infrastructure overlaps considerably with Volt Typhoon’s “Silent Train” covert access network.

KeyDrift is a custom malware framework that is designed to operate in Cisco SD-WAN controller environments. Talos assesses with high confidence that the framework is designed to provide long-term persistent access and automated exfiltration of sensitive keying material. KeyDrift operates inside SD-WAN control-plane processes and is capable of intercepting decrypted control traffic, extracting control-session metadata and data-plane keying material, and staging or transmitting the collected material using encrypted records.

The framework's primary component is PolyFlame, a memory-resident module deployed through modified runit service paths. PolyFlame is injected into legitimate running vdaemon processes, and it can also masquerade as a packed “aaamgrd” loader variant. Once resident, PolyFlame interposes socket, DTLS, and runtime-linker behavior through functions such as recvfrom, sendto, getpeername, dlopen, dlsym, mprotect, and “/proc/%d/maps” parsing. This gives KeyDrift access to SD-WAN control-plane traffic from inside legitimate controller daemon execution rather than through a conventional endpoint beacon.

LittleFilch, another component of the KeyDrift framework, provides the collection and exfiltration capability identified in the framework. The module hooks “SSL_read” inside vdaemon, inspects decrypted control-plane buffers, extracts keying material for a list of predefined edge nodes, and stages the data locally in encrypted format for exfiltration.

Talos assesses with high confidence that KeyDrift's intended operational purpose is Cisco SD-WAN control-plane collection: persistent controller residence, in-band traffic access, key-material extraction from decrypted control messages, and encrypted staging or exfiltration of the recovered material. Observed variations of the KeyDrift modules and deployment mechanisms suggest active development of the framework’s capabilities.

KeyDrift analysis

KeyDrift uses Cisco SD-WAN runit service paths as its primary execution anchor. In the PolyFlame sshd deployment, the actor modifies the service run script, remounts /rootfs.rw executable, launches a malicious script “conf_sshd” in the background, and then starts the legitimate sshd service. The loader script enumerates running vdaemon PIDs, records them in “/tmp/system-vdaemon”, and invokes the injector component “rsshd” to inject PolyFlame (“libdssl.so”) into each process.

Recovered conf_sshd logic uses the same control flow across reviewed samples:

Runit launchers

The observed sshd runit launcher preserves normal Cisco SD-WAN sshd startup logic while adding two malicious lines before service execution, which remount “/rootfs.rw” executable and background execution of conf_sshd, which then drives rsshd injection into vdaemon.

The recovered aaamgr runit launcher from an affected vBond appliance uses a parallel service-wrapper pattern, but it executes the packed aaamgrd PolyFlame loader directly. The deletion of the writable-overlay PAM configurations for sshd and login before remounting “/rootfs.rw” executable if part of the legitimate script, along with the invocation of the aaamgrd daemon via Python:

PolyFlame

PolyFlame is the primary operational module in the KeyDrift framework. PolyFlame operates at the socket and DTLS control-plane layer. PolyFlame serves two primary purposes:

• Command execution via a TinyShell-styled backdoor
• Intermediate C2 that can forward commands to and from the C2 to other peers

PolyFlame is primarily injected into the vdaemon process, providing operational obfuscation and access to all in-process state: DTLS session keys, vEdge topology, OMP routes, and policy tables. No hardcoded IPv4 addresses, binding ports, callback domains, URLs, host headers, or polling interval were recovered from the analyzed PolyFlame samples. PolyFlame is designed for in-band control or tasking over Cisco SD-WAN control-plane traffic rather than a conventional fixed external beacon.

This implant is meant to serve as a hook of the recvfrom() API call. The original recvfrom is replaced by a malicious subroutine in the vdaemon process. When recvfrom is called in the vdaemon process, the malicious subroutine will first execute the real/legitimate recvfrom() API to obtain the C2 IP address info for communicating with it in the future.

PolyFlame’s time check

The recvd data from the C2 consists of the MD5 value of a specific DATE. PolyFlame will calculate the local time on the device in format “%Y-%m-%d" and calculate its MD5 hash. If the MD5 calculated by the device does not match with the one sent by the C2, the implant will stop further execution. Otherwise, the implant then uses an “administrative code” from the C2 and performs an action.

PolyFlame’s tasking

PolyFlame contains an administrative mode that processes the admin code sent by the C2, that defines operations — it's one of the first flags checked in the backdoor:

• Code = 1: Generate random bytes and send to C2. This is likely a check-in beacon or heartbeat for the C2.
• Code = 2: Set implant type to backdoor (TinyShell) or intermediate C2.
• Code = 3: Set up the command handler for the intermediate C2.
• Any other code value: Check the implant type flag currently set. Based on the implant type flag, either send the accompanying data to TinyShell or the intermediate C2 component for processing.

PolyFlame’s command execution

PolyFlame contains a backdoor that matches the capabilities of TinyShell: file read, file write, and arbitrary command execution, but not interactive shell. This backdoor component’s implementation is quite similar to TinyShell, but the command codes differ. PolyFlame handles the following command codes:

• Code = 0x100: Execute command using “/bin/sh -c <command>”
• Code = 0x200: Write file to disk.
• Code = 0x300: Read file from disk and send to the C2.

PolyFlame as an intermediate C2 component

The intermediate C2 component is a one-to-many handler (somewhat like a one-to-many multiplexer) — meaning the implant can connect to only one C2 but can connect to many peers who can be served by the intermediate C2 component. Similar to the TinyShell-backdoor component, the intermediate C2 component also accepts and processes specific command codes from the C2:

• Code = 0x403: Create a thread to connect to the specified peer IP. Make a new connection and keep socket alive until specified.
• Code = 0x404: Send data recvd from the C2 to a connected peer.
• Code = 0x405: Remove a peer from the list of active connections.
• Code = 0x407: Send a response recvd from a peer, back to the C2.
• Code = 0x408: Set a specific value in memory.

PolyFlame variant: aaamgrd

 Talos has observed a distinct PolyFlame variant that masquerades as the aaamgr service. The legitimate Cisco aaamgr component is a Python package; it does not normally appear as a compiled ELF runit service. This PolyFlame variant is executed by a malicious runit service under “/etc/sv/aaamgr/” with aaamgrd and a modified run launcher.

aaamgrd is a statically linked ELF64 executable with no section headers, a single RWE loader segment, and an RC4-encrypted embedded ELF payload. The loader uses direct syscalls including ptrace, fork, wait4, kill, tgkill, mmap, and mprotect. It performs an anti-debug check by deobfuscating /proc/%d/status and TracerPid: and exits if a tracer is present.

The observed staging sequence was:

Figure 4. PolyFlame staging sequence.

Note that in addition to the implant execution staging, there are also indications of timestomping.

LittleFilch: libcommon.so TLS interception module

LittleFilch is a control-session interception module positioned to collect data-plane keying material from control sessions visible to the injected vSmart process.

LittleFilch installs an SSL_read hook inside vdaemon. The hook calls the original SSL_read, then processes returned buffers only when the returned size is greater than 0x18F, the first decrypted byte is 0x07, and three marker patterns are checked for presence. These marker bytes are followed by the actual artifacts that LittleFilch aims to record:

Marker bytes	Parsed field	Length	Notes
40 03 06	Public IP	4 bytes	vEdge public / transport IP
40 0C 04	Peer system-IP	4 bytes	vEdge OMP system-IP
05 01 0C 06 40	Binary key field	32 (0x20) bytes	Assessed OMP-distributed AES-256 IPsec data-plane key material

LittleFilch records the extracted keying material and RSA-encrypts it before writing the output to “/var/tmp/vdaemon.bin”. It can then send the encrypted content over UDP in a DTLS 1.2 application-data style record.

LittleFilch expects its configuration file — located at “/var/tmp/vdaemon.conf” —  to contain two host port lines: one local bind IP/port and one remote destination IP/port. It deletes “/var/tmp/vdaemon.conf” after reading it. Talos has not been able to recover the “vdaemon.conf” file.

KeyDrift components

Component	Primary hook/surface	Observed scope	Confirmed function
PolyFlame libdssl.so	Socket / DTLS / runtime linker interposition inside vdaemon	Multiple affected controller roles	In-band control-plane interception and tasking; exact command format unresolved
rsshd	Ptrace injection	Multiple affected controller roles	Injects libdssl.so into vdaemon by PID
conf_sshd	Shell-based PID enumeration	Multiple affected controller roles	Locates vdaemon PIDs and records injection output
Trojanized run	Runit service launcher	Multiple affected controller roles	Remounts overlay executable and launches injector chain
Packed aaamgrd	Packed loader, direct syscalls, anti-debug	Affected vBond appliance evidence	Decrypts and runs embedded PolyFlame payload; tampers with PAM configs
LittleFilch libcommon.so	OpenSSL SSL_read hook	Affected vSmart process evidence	Extracts control-session identifiers and assessed data-plane key material from decrypted control traffic
vdaemon.bin	Encrypted staging file	Affected vSmart process evidence	Stores RSA-encrypted LittleFilch telemetry records
vdaemon.conf	Runtime endpoint config	Affected vSmart process evidence	Supplies local and remote UDP endpoint configuration; deleted after read

MITRE ATT&CK techniques 

Technique	ID	Notes
Process Injection: Ptrace System Calls	T1055.008	rsshd injects libdssl.so into vdaemon by PID
Hijack Execution Flow: Dynamic Linker Hijacking	T1574.006	PolyFlame uses dlsym(RTLD_NEXT, ...), dlopen, and runtime interposition
Boot or Logon Initialization Scripts	T1037	Modified runit service scripts launch KeyDrift components
Create or Modify System Process	T1543	Malicious service paths under etc/sv/sshd/ and etc/sv/aaamgr/
Masquerade Task or Service	T1036.004	sshd and aaamgr service-name masquerading
Unix Shell	T1059.004	conf_sshd and recovered operator staging commands
Software Packing	T1027.002	aaamgrd uses packed embedded ELF payload
System Checks	T1497.001	aaamgrd checks TracerPid before unpacking
Timestomp	T1070.006	touch --reference= and chmod --reference= staging commands copied reference file metadata
Network Sniffing	T1040	PolyFlame and LittleFilch intercept SD-WAN control-plane traffic
Encrypted Channel: Symmetric Cryptography	T1573.001	PolyFlame AES implementation; aaamgrd RC4 packer; LittleFilch RSA-encrypted records

Recommendations

Cisco has released patches for CVE-2026-20127 and published a hardening guide for Cisco Catalyst SD-WAN deployments available here. Organizations are strongly advised to prioritize the application of these patches and follow the guidance provided.

Following the identification of UAT-11473 activity, Talos strongly recommends that organizations monitor their systems for indicators of post-compromise activity. Should any signs of unauthorized activity be detected, organizations should immediately activate their incident response frameworks. Contact the Cisco Technical Assistance Center (TAC) for support by initiating a TAC request.

Coverage

Snort SIDs are already available for CVE-2026-20127: 65938, 65958.

Snort SIDs for the malicious artifacts illustrated in this blog:

• Snort v2: 67387 through 67416
• Snort v3: 7:44 through 7:73

Amy Blackshaw joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices to discuss how frontier AI is accelerating attacks and reshaping identity security. She explains why organizations must shift their focus from preventing initial access to limiting how long compromised identities remain useful to attackers. Amy explores how zero standing privileges, just-in-time access, and automated identity containment can help organizations reduce their exposure as threats move at machine speed.

ICE’s Homeland Security Investigations is engaged in far-reaching spying against left-wing activists that rivals the FBI and CIA crackdowns on the Civil Rights and anti-war movements.

Jess Asato’s public campaigning for victims of online abuse put her in the crosshairs of Grok’s deepfake scandal. Then the UK member of parliament became a victim of the abuse herself.

Winter is coming, and that means Ukraine has to gear up for another brutal season of strikes on its energy infrastructure - Russia’s bid to cut off power and heat, making life harder for all Ukrainians. Earlier this year, Ukrainian forces reversed the enemy’s territorial gains, and now Vladimir Putin appears to be stepping up long-range strikes targeting not just Ukraine’s energy system but also its water, railways, and bridges. The Ukrainians have responded with their own long-range attacks on Russian energy sites. Since the full-scale invasion began, former CIA director and retired four-star general David Petraeus has made numerous trips to Ukraine. He sits down with SpyCast host Sasha Ingber to discuss not just major developments on the battlefield but also the quieter side of the war: the covert maneuvering behind closed doors and the threats of sabotage troubling the European continent.

To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark web—never suspecting who she’d find hiding there.

Roman Arutyunov, Co-Founder and Chief Product Officer at Xage Security, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices. Roman discusses why Zero Trust must evolve beyond controlling access to governing what identities, workloads, and AI agents can actually do once connected. He explores how real-time authorization, least-privilege enforcement, and just-in-time permissions can help organizations secure increasingly autonomous environments.

The Kremlin is not a fan of Alex Goldfarb. He left the Soviet Union as a scientist, becoming a prominent author and human rights activist. In 2006, he was in the room with ex-FSB officer Alexander Litvinenko, reading his dying words, which accused Vladimir Putin of assassination by radioactive polonium. Today, Alex's memoir, Refusenik's Son, traces a complicated family history made clear only decades later. His father, David, was a Jewish scientist denied permission to leave the Soviet Union - one of the so-called "refuseniks." David had been a prominent microbiologist in the 1970s and '80s, when Moscow's secret bioweapons program was under development. But only after an exiled KGB officer contacted Alex in 2010 did the full reason for his father's confinement become clear. It's a winding story involving an anthrax accident and a media leak, a Soviet scientist and a U.S. journalist trying to help him. Two men pulled unknowingly into a tide of suspicion.

This research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future’s Insikt Group. Details of the joint research and presentation are available here.

• Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. 
• In activity observed from June 2025 through August 2026, Talos identified four infection-chain types that use macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a crafted WinRAR archive exploiting CVE-2025-8088. The recovered payloads include several custom reverse shells that provide interactive remote access. 
• Three publicly accessible staging directories and GitHub repository history exposed payload builds, tool inventories, and changes to command-and-control (C2) infrastructure. These operational security lapses gave us direct visibility into the group's recent activity. 
• The files recovered from the exposed infrastructure suggest preparation for post-compromise operations and potential activity against Linux hosts and internet-facing appliances.  
• Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus, based on infrastructure access, language artifacts, sample submissions, working hours analysis, and regional targeting interests.

---

Background 

Cisco Talos and Recorded Future Insikt Group jointly investigated UAT-6275 activity targeting government organizations across the Commonwealth of Independent States (CIS). The investigation uncovered three publicly accessible staging directories and a previously unreported GitHub repository used to host malicious scripts and payloads. These exposed assets provided visibility into the threat actor's malware development, infrastructure changes and preparations for additional intrusion activity. 

Talos tracks this activity as UAT-6275, while Recorded Future tracks it as TAG-193. It overlaps with Silent Lynx (first reported by Seqrite) and sits within a broader set of campaigns connected to YoroTrooper, which we first reported in 2023. Subsequent research on Tomiris (Kaspersky), ShadowSilk (Group-IB), Cavalry Werewolf (BI.ZONE), and Hydra Saiga (VMRay) identified overlapping indicators across these reported clusters. We assess that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster. However, we continue to track them separately because we have not observed direct indicator or toolset overlap between the two.

This post summarizes our joint Virus Bulletin 2026 white paper, “Break the silence: tracking Silent Lynx through exposed infrastructure” which contains the full technical analysis and indicators of compromise (IOCs).

Victimology 

UAT-6275's targeting is concentrated in Central Asia and the wider CIS region. Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

Government and diplomatic affairs 

UAT-6275 targets government institutions responsible for diplomacy, economic development, agriculture, and environmental management. These organizations hold information that can inform bilateral negotiations, economic planning, and regional security decisions.

Our network flow analysis identified activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026 and a Belarusian government entity ahead of a bilateral meeting in April. This timing may indicate an interest in regional diplomatic developments.

The decoy documents we recovered also suggest an interest in diplomatic relations, international trade, and aviation. Examples include a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs.

Water security and resource management 

The group’s interest in regional resources spans environmental management and energy. Talos observed activity involving an Armenian government entity responsible for environmental matters and Uzbekistan’s Smart Forestry initiative, consistent with earlier reporting on Silent Lynx targeting water resource organizations across Central Asia. 

Energy-themed decoys included a cooperation proposal between Turkmenistan’s state oil company, Turkmennebit, and Russia’s Orsk Oil Refinery, used in an August 2025 sample. The refinery supplies petroleum products to Kazakhstan and later shut down after a Ukrainian drone strike in August 2026, with repairs expected to take up to six months. These ties suggest a possible intelligence interest in regional fuel supplies and the war’s implications for Kazakhstan’s energy security.

Campaign timeline 

Since Seqrite first reported Silent Lynx in January 2025, we have identified at least eight campaigns across the region through May 2026. These include malware delivery targeting Russia, Turkmenistan, and Uzbekistan; a credential-harvesting site impersonating Azerbaijan’s State Agency for Public Service; and lures referencing the China–Central Asia Summit and Russian energy infrastructure. In 2026, we also observed activity involving government entities in Tajikistan, Armenia, and Belarus, as well as Uzbekistan’s Smart Forestry initiative in May. 

Infrastructure and malware delivery 

Talos identified three publicly accessible staging directories containing malware and tools of UAT-6275. One sample led to the previously unreported GitHub repository, where the group hosted PowerShell scripts and payloads. Its commit history allowed us to track infrastructure changes and malware development.

The group relies on lightweight reverse shells, including Chvost, Laplas, and PickleShell, to issue commands on compromised systems.

We also recovered Linux-compatible tooling and a publicly available proof-of-concept exploit for FortiWeb CVE-2025-25257 from UAT-6275 infrastructure. These findings suggest interest in expanding the group’s operational capabilities. 

Four infection chains 

UAT-6275 used malicious documents, executable downloaders, and shortcuts to deliver malware, and later incorporated a WinRAR exploit. Talos categorized the recovered samples into four infection chains, A – D, based on how they retrieve and execute their payloads.

The first Chain A samples, observed in June 2025, used macro-enabled Word documents to download and execute a second-stage binary. In July 2025, we observed Chain B downloaders built with PS2EXE, a tool that packages PowerShell scripts as standalone Windows executables. These downloaders retrieved reverse-shell payloads and created scheduled tasks for persistence. 

We first observed Chain C in October 2025. A malicious shortcut launches PowerShell to retrieve and execute a GitHub-hosted script that provides remote shell access. Later samples also downloaded PickleShell and placed it in the Windows Startup folder for persistence.

In April 2026, we identified a RAR archive that exploited CVE-2025-8088 in WinRAR to place PickleShell in the Windows Startup folder (Chain D). The payload runs at the next user sign-in. This was the first vulnerability exploit we observed in UAT-6275’s malware delivery.

Kazakhstan nexus assessment 

Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus. Supporting evidence includes Russian-language artifacts, apparent malware-testing submissions from Kazakhstan shortly after compilation, and operator activity consistent with UTC+5 working hours.

Looking ahead 

UAT-6275’s sustained activity and adoption of new delivery techniques suggest the group will continue pursuing access to government organizations across Central Asia and the CIS. Its interest in environmental agencies, economic ministries, and energy infrastructure reflects the intelligence value of regional diplomacy and resource management. 

Defenders in these sectors should monitor unexpected PowerShell activity and payload downloads from public services such as GitHub, alongside scheduled tasks and Startup-folder changes. Keeping archive utilities patched can help reduce exposure to the exploit-assisted delivery observed in this campaign. 

For further details on this research and our accompanying presentation, see “Break the Silence: Tracking Silent Lynx Through Exposed Infrastructure” on Virus Bulletin’s website, as well as Recorded Future’s related blog post.

Coverage 

The following ClamAV signatures detect and block this threat: 

• Win.Backdoor.PickleShell-10060602-0 
• Win.Backdoor.Chvost-10060603-0 
• Win.Malware.Generic-10060604-0 
• Win.Malware.LAPLAS-10060605-0 
• Win.Malware.LAPLAS-10060606-0 
• Win.Proxy.Generic-10060628-0 

The following Snort rules cover this threat: 

• Snort 2: 1:11192, 1:15306, 1:46983, 1:47398 
• Snort 3: 1:46983, 4:16 

IOCs

IOCs for this research can be found at our GitHub repository here. 

The trial of a former Ukrainian special forces officer, identified as Serhii K., is set to begin October 14th in Hamburg. German investigators have been unrelenting in their pursuit of justice since the attack on the Nord Stream pipelines, which carried Russian gas to Germany. It was about seven months into Russia’s full-scale invasion of Ukraine. Scandinavian seismologists detected what appeared to be an undersea earthquake near a Danish island, on the floor of the Baltic Sea. Denmark, Germany, and Sweden opened investigations, but only Germany pushed forward. Since then, The Wall Street Journal’s chief European political correspondent, Bojan Pancevski, has uncovered what happened in his book, The Nord Stream Conspiracy. We sat down with him to talk about the operation and the fallout, part of which is set to unfold in a German courtroom.

Sanjay Jeyakumar, Co-Founder and CTO at Abnormal AI, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices conversation about why AI agents are challenging traditional security models. Using a recent OpenAI and Hugging Face incident as an example, Sanjay explains how agents can combine legitimate permissions, stale credentials, and over-privileged identities in unexpected ways. He discusses why securing agentic AI requires organizations to look beyond known threats and focus on whether identities are behaving as expected.

Steve Ryan, Founder and CEO at Trinity Cyber, joins Dave Bittner on the CyberWire Daily podcast for a sponsored Industry Voices. Steve discusses how frontier AI is collapsing the time between vulnerability discovery and exploitation, shifting cyberattacks from human speed to machine speed. He explains why this acceleration challenges traditional detection and response models and what it means for organizations to build defenses capable of surviving first contact with an AI-enabled threat.

In the spring of 1944, three elite commandos parachuted into Hungary. The country was aligned with Nazi Germany, and these men intended to be captured in what was meant to look like a failed operation. Their real mission was to help Hungary switch to the Allied side. But three days later, Germany launched a preemptive invasion. The men were captured by the Nazis, imprisoned, and interrogated. They used their interrogation as a chance to fool Adolf Hitler into thinking an Allied invasion would come from southeastern Europe, drawing German troops away from Normandy ahead of D-Day. Author Jason Bell unravels this daring and untold story in his new book, Operation Sparrow.

Traverse barriers and checkpoints in the occupied West Bank—your choices reflect the reality of nearly 3.5 million Palestinians who live there.