The new UAT-6275 reporting is useful partly because it exposes a tempting inference: government and resource-related targeting, plus Linux-compatible tools in staging infrastructure, can start sounding like an OT campaign. The public evidence does not establish that transition—or confirmed theft of negotiation material.
One concrete detection issue: Talos describes four infection chains. The WinRAR route places a payload in Startup for execution at the next sign-in. A universal Office-to-PowerShell-to-GitHub-to-task correlation would not cover it. Test the delivery branches separately, then scope what the compromised identity could reach.
Our analysis separates information value, demonstrated access, and process capability. It also rejects waiting for a complete set of OT indicators before responding to verified unauthorized industrial activity.
Read the report.