UAT-6275

☆ pin

Also known as TAG-193, YoroTrooper, Silent Lynx

Reports

First seen

Oct 14, 2026

Last seen

Oct 15, 2026

Motivation

Espionage

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Government ×2

Top ATT&CK techniques

T1566 Phishing ×3T1105 Ingress Tool Transfer ×2T1547.001 Registry Run Keys / Startup Folder ×2T1204 User Execution ×1T1219 Remote Access Software ×1T1059.001 PowerShell ×1T1190 Exploit Public-Facing Application ×1T1071.001 Web Protocols ×1T1547 Boot or Logon Autostart Execution ×1T1583.006 Acquire Infrastructure: Web Services ×1T1566.001 Phishing: Spearphishing Attachment ×1T1059 Command and Scripting Interpreter ×1

Indicators

cve ×6hash_md5 ×4hash_sha256 ×4filename ×3

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-8088 (exploited)CVE-2014-125110 CVE-2015-1000013 CVE-2025-25257 CVE-2026-104935 (exploited)

Recent reports

Info