Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor identified as Silent Lynx has been linked to a series of recent attacks aimed at government entities within the Commonwealth of Independent States (CIS).

Investigations indicate that this activity, observed from June 2025 to August 2026, incorporates four distinct infection chains utilizing macro-enabled documents, PS2EXE downloaders, PowerShell scripts hosted on GitHub, and meticulously crafted WinRAR archives that exploit the vulnerability designated as CVE-2025-8088.

These attacks facilitate the deployment of customized reverse shells, including FoalShell, Chvost, Laplas, and PickleShell, which enable interactive remote access to compromised systems. This threat has been tracked by Cisco Talos and Recorded Future Insikt Group under the identifiers UAT-6275 and TAG-193.

"UAT-6275 primarily targets Central Asia and the broader CIS region," noted security researcher Ashley Shen. "Across the examined campaigns, the victims and associated lure themes span nine nations: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."

Silent Lynx was first documented publicly by Seqrite Labs in early 2025, underscoring the actor's focus on attacks directed at embassies, legal professionals, government-sponsored financial institutions, and think tanks in Kyrgyzstan and Turkmenistan.

The group is believed to be a Kazakhstan-based threat actor that has been operational since at least 2020, showing links to other clusters such as YoroTrooper (also referred to as Comrade Saiga, ShadowSilk, and SturgeonPhisher), ShadowSilk, Cavalry Werewolf, and Tomiris.

While UAT-6275 and YoroTrooper are suspected to be part of a broader activity cluster, no direct indicators or toolsets have been found to overlap between the two.

In a related disclosure, VMRay reported earlier this year that a threat cluster referred to as Hydra Saiga had compromised at least 34 organizations across eight countries since December 2024, with reconnaissance activities extending to over 200 additional targets worldwide.

It is important to note that Comrade Saiga and Hydra Saiga refer to the same adversary; the "hydra" prefix in the tracking name highlights the group's significant focus on infiltrating infrastructure associated with water resources in Central Asia, employing a combination of custom implants developed in Rust, Go, and Python alongside Living-off-the-Land techniques.

Strategies employed by Silent Lynx involve spear-phishing campaigns utilizing emails that contain documents related to diplomatic relations, international trade, energy, and aviation. At least eight campaigns have been identified in the region from January 2025 to May 2026.

The phishing emails are sent from compromised governmental accounts and feature official-looking documents to enhance the credibility of the social engineering attacks. Recorded Future reported that identified lures included a diplomatic letter directed to Armenia's Ministry of Foreign Affairs, an application form concerning Turkmenistan's airspace, and a business proposal involving Russia's Orsk Oil Refinery.

Additionally, three publicly accessible staging directories associated with the threat actor have been discovered, which host Linux-compatible tools and a publicly available proof-of-concept exploit for CVE-2025-25257, an SQL injection vulnerability in Fortinet FortiWeb. This suggests a potential expansion of the threat actor's operational capabilities.

The infection pathways utilized have been outlined as follows:

• June 2025: The use of macro-enabled Word documents to download and execute a secondary binary.
• July 2025: Employment of downloaders created with PS2EXE, a tool that converts PowerShell scripts into Windows executables, to retrieve reverse-shell payloads and set up scheduled tasks for persistence.
• October 2025: The introduction of a malicious shortcut (LNK) within a RAR archive to invoke PowerShell, which is responsible for retrieving and executing a GitHub-hosted script to access remote shells. In subsequent iterations, this method downloads PickleShell and stages it in the Windows Startup folder to ensure it launches automatically upon user login.
• April 2026: Leveraging a RAR archive that exploits a WinRAR vulnerability (CVE-2025-8088) to introduce PickleShell into the Windows Startup folder.

The April 2026 infection sequence signifies the first instance in which UAT-6275 has weaponized a security vulnerability as part of its malware distribution strategies.

According to Talos, "UAT-6275's ongoing activity and the adoption of new delivery techniques imply that the group will persist in targeting government organizations across Central Asia and the CIS. Its focus on environmental agencies, economic ministries, and energy infrastructures highlights the intelligence value associated with regional diplomatic relations and resource management."