Key points
- Silent Lynx exploits CVE-2025-8088 in WinRAR alongside macro-enabled documents and PowerShell scripts to breach CIS government networks.
- The campaign, tracked as UAT-6275 and TAG-193, was active from June 2025 through August 2026 across nine countries including Kazakhstan and Russia.
- Compromised hosts receive custom reverse shells such as FoalShell and Chvost that provide interactive remote access to the attackers.
Security researchers from Cisco Talos and Recorded Future Insikt Group have attributed a series of intrusions against government organizations in the Commonwealth of Independent States to the threat actor known as Silent Lynx. The activity, observed between June 2025 and August 2026, utilizes four distinct infection chains. One notable chain involves crafted WinRAR archives that exploit CVE-2025-8088, while others rely on macro-enabled documents, PS2EXE downloaders, and GitHub-hosted PowerShell scripts to establish initial access.
In plain English
Attackers are sending deceptive emails to government workers in Central Asia and the broader CIS region. These messages contain files that look like legitimate diplomatic, trade, energy, or aviation documents. When victims open these files, the embedded code executes. In some cases, this involves a flaw in WinRAR that allows malicious code to run. Once inside, the attackers install custom reverse shells that let them control the computer remotely without the user knowing.
The background
Silent Lynx was first documented by Seqrite Labs in early 2025, noting attacks on embassies and banks in Kyrgyzstan and Turkmenistan. Researchers assess the group has been active since at least 2020 and likely originates from Kazakhstan. The actor shares overlaps with clusters like YoroTrooper, ShadowSilk, and Tomiris. The campaign targets span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
What changes now
The campaign results in the deployment of custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell. According to Cisco Talos and Recorded Future Insikt Group, these tools facilitate interactive remote access to compromised hosts. The tracking monikers for this activity are UAT-6275 and TAG-193. Earlier this year, VMRay noted related activity from a cluster it calls Hydra Saiga, which compromised 34 organizations since December 2024, though no direct tool overlap with Silent Lynx has been confirmed.
Who needs to act first
Teams managing government or diplomatic infrastructure should prioritize scanning for the identified reverse shells and checking for unauthorized PowerShell executions. Since multiple infection chains are used, focus on validating the integrity of downloaded archives and disabling macro execution in documents unless explicitly required. Verify that endpoint detection rules cover the specific shell names mentioned in the report. Ensure that remote access tools are strictly controlled and that any new connections are authenticated through established, secure channels before granting administrative privileges.
Background: Initial access
Initial access is the stage where attackers first enter a network, often via spear phishing or stolen credentials. The MITRE ATT&CK framework maps these techniques so defenders can detect them early. You must verify identity strictly and monitor for unusual login patterns to block entry.
Read the full guide: Initial Access MITRE: How Attackers Enter and How to Stop Them
What to do and how to stay safe: WinRAR
- Review email logs for attachments related to diplomatic, trade, or energy themes from the past year and scan them with updated security tools.
- Audit Windows systems for the presence of the named reverse shells: FoalShell, Chvost, Laplas, and PickleShell.
- Restrict PowerShell execution policies to prevent unsigned or remote scripts from running automatically on workstations.
- Monitor network traffic for unusual outbound connections that may indicate reverse shell activity during business hours.
Step-by-step guide: DDoS Protection: 8 FAQs on Mitigation and Architecture
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which countries are being targeted by Silent Lynx?
The campaign has affected government organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
What specific vulnerability in WinRAR is being exploited?
The attackers are using CVE-2025-8088 to execute code through crafted WinRAR archives as part of their infection chain.
Are Silent Lynx and Hydra Saiga the same group?
Comrade Saiga and Hydra Saiga refer to the same threat actor, but researchers have not observed direct indicator or toolset overlap between that cluster and Silent Lynx.
