Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).

The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.

The attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded Future Insikt Group, which are tracking the campaign under the monikers UAT-6275 and TAG-193.

“UAT-6275’s targeting is concentrated in Central Asia, and the wider CIS region,” security researcher Ashley Shen said. “Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.”

Silent Lynx was first publicly documented by Seqrite Labs in early 2025, highlighting the threat actor’s attacks on embassies, lawyers, government-backed banks, and think tanks across Kyrgyzstan and Turkmenistan.

It’s assessed to be a Kazakhstan-nexus threat actor active since at least 2020, sharing overlaps with other clusters codenamed YoroTrooper (aka Comrade Saiga, ShadowSilk, and SturgeonPhisher), ShadowSilk, Cavalry Werewolf, and Tomiris.

It’s suspected that both UAT-6275 and YoroTrooper are part of the same broader activity cluster, although no direct indicator or toolset overlap has been observed between the two.

Earlier this year, VMRay disclosed that a threat cluster it tracks as Hydra Saiga compromised at least 34 organizations across 8 countries since December 2024, with reconnaissance efforts extending to over 200 additional targets across the world.

It’s worth noting that both Comrade Saiga and Hydra Saiga refer to the same threat actor. The “hydra” prefix in the tracking alias is a reference to the adversary’s heavy focus on breaching infrastructure linked specifically to water resources in Central Asia using a mix of custom implants written in Rust, Go, and Python and Living-off-the-Land techniques.

Attack chains mounted by the threat actor involve the use of spear-phishing emails containing diplomatic relations, international trade, energy, and aviation-themed decoy documents. No less than eight campaigns have been identified across the region between January 2025 and May 2026.

The phishing emails are sent from compromised government accounts and make use of official-looking documents to lend the social engineering attack a veneer of credibility. “Identified lures included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery,” Recorded Future said.

What’s more, three publicly accessible staging directories linked to the threat actor have been found to host Linux-compatible tooling and a publicly available proof-of-concept exploit for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb, suggesting a possible expansion of the threat actor’s operational capabilities.