TAG‑193 Conducts Regional Espionage Campaign Against Central Asian Government Agencies
What Happened – Joint research by Cisco Talos and Recorded Future identified a sustained cyber‑espionage operation (TAG‑193, also known as UAT‑6275 / Silent Lynx) that has been compromising government networks in Russia, Kazakhstan, Tajikistan, Belarus, Armenia and Uzbekistan since early 2025. The group delivers malicious payloads via spear‑phishing documents and spoofed services, focusing on diplomatic, economic‑development, agriculture and environmental‑management ministries.
Why It Matters for Trust & Control Assurance
- The campaign illustrates the need for continuous monitoring of access‑control events and phishing‑resilience metrics – core evidence that a control‑assurance program must collect and retain.
- Demonstrates how gaps in security‑awareness training can be weaponised to infiltrate high‑value public‑sector systems, underscoring the importance of a documented, repeatable security‑awareness curriculum.
- Aligns with the Security Awareness Training capability: evidence of training completion, phishing‑simulation results, and policy acknowledgment become defensible audit artifacts across frameworks such as NIST CSF 2.0.
Who Is Affected – Government ministries responsible for diplomacy, economic development, agriculture, water resources and forestry across the CIS and Central Asia.
Recommended Actions
- Review and update phishing‑simulation programs; ensure all staff complete the latest security‑awareness modules and retain completion records.
- Map the “awareness and training” control to your audit‑readiness framework (e.g., NIST CSF 2.0 Identify → PR.AT).
- Collect and store evidence of training, simulated‑phishing results, and remediation actions in a central Trust Center for continuous audit readiness.
Technical Notes – The group leverages custom malware delivered through weaponised Office documents and forged service login pages. No specific CVE is cited; the attack vector is primarily phishing with credential‑harvesting payloads. Source: https://www.recordedfuture.com/blog/tag193-regional-espionage-operations