Silent Lynx exploits WinRAR flaw in CIS government attacks

Silent Lynx, a Kazakhstan-linked threat actor, has used four infection chains to target government organisations across Central Asia and the wider Commonwealth of Independent States (CIS), according to new research from Cisco Talos and Recorded Future’s Insikt Group.²³

The campaigns ran from June 2025 through August 2026 and included malicious documents, PowerShell downloaders, GitHub-hosted scripts and crafted WinRAR archives. The latest activity is significant because one of those chains exploited CVE-2025-8088, a WinRAR path-traversal vulnerability, to place the PickleShell reverse shell in the Windows Startup folder.¹²

What the campaign targets

The activity is concentrated in Central Asia and the CIS. Researchers identified victims and lure themes across Kazakhstan, Tajikistan, Turkmenistan, Uzbekistan, Kyrgyzstan, Armenia, Azerbaijan, Russia and Belarus.² The targets include government bodies and organisations connected to diplomacy, energy, aviation, public services and economic affairs.

The attackers typically send spear-phishing emails from compromised government accounts. The messages use official-looking documents to make the request appear credible, including a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application and a business proposal about Russia’s Orsk Oil Refinery.³

Once a victim opens the lure, the campaign can establish persistence and deliver a custom reverse shell. Cisco Talos tracks the activity as UAT-6275, while Recorded Future’s Insikt Group uses TAG-193. The implants identified across the wider set of campaigns include FoalShell, Chvost, Laplas and PickleShell.¹²

Four infection chains

The earliest chain described in the new research used macro-enabled Word documents in June 2025. Those documents downloaded and ran a second-stage binary. In July 2025, the attackers used downloaders packaged with PS2EXE, a tool that turns PowerShell scripts into Windows executables, to retrieve reverse-shell payloads and create scheduled tasks for persistence.¹

A later campaign in October 2025 hid a malicious shortcut inside a RAR archive. Opening the shortcut launched PowerShell, which retrieved and executed a script hosted on GitHub. Subsequent versions downloaded PickleShell and placed it in the Windows Startup folder so the shell would launch when a user signed in.¹

The April 2026 chain kept that general approach but added the WinRAR vulnerability. CVE-2025-8088 allowed a specially crafted archive to drop PickleShell into the Startup folder without relying solely on the earlier shortcut technique. Cisco Talos described this as the first observed instance of UAT-6275 weaponising a security flaw as part of its malware delivery methods.²

The campaign also appears to be testing broader capabilities. Researchers found three publicly accessible staging directories containing Linux-compatible tooling and a proof-of-concept exploit for CVE-2025-25257, an SQL injection vulnerability affecting Fortinet FortiWeb.¹³ The discovery does not prove that every tool or exploit was used in the government intrusions, but it suggests the group has access to an expanding set of options.

Where Silent Lynx fits

Silent Lynx was first publicly documented by Seqrite Labs in early 2025 after attacks on embassies, lawyers, government-backed banks and think tanks in Kyrgyzstan and Turkmenistan.¹ Researchers assess that the group has a Kazakhstan nexus and has been active since at least 2020.

The campaign has overlaps with clusters tracked as YoroTrooper, ShadowSilk, Cavalry Werewolf and Tomiris, although the latest reporting does not establish that all of those names describe the same operators. UAT-6275 and YoroTrooper may belong to a broader activity cluster, but researchers have not identified direct overlap in indicators or toolsets.²

The wider threat picture is substantial. VMRay previously reported that the related Comrade Saiga or Hydra Saiga cluster had compromised at least 34 organisations across eight countries since December 2024, while reconnaissance extended to more than 200 additional targets.³ That reporting links the group’s interests to critical infrastructure and water resources in Central Asia.

Our opinion

This campaign matters less because WinRAR is a familiar piece of software than because it shows how quickly a regional espionage operation can combine ordinary social engineering with a newly weaponised vulnerability. A convincing government-themed email remains the entry point, but the archive gives the attackers a more reliable route to persistence once the victim opens it.

The reporting also shows why defenders should avoid treating a single malware name or vulnerability as the whole incident. The operators moved between macros, packaged PowerShell, malicious shortcuts, GitHub-hosted scripts and a WinRAR exploit. Organisations in the affected regions need layered controls: patching WinRAR and Fortinet appliances, disabling macros where possible, monitoring archive extraction into Startup locations, restricting script interpreters and auditing compromised government accounts.

Cisco Talos says the group’s sustained activity and adoption of new delivery techniques indicate that it is likely to keep pursuing government organisations across Central Asia and the CIS.² For defenders, that is the clearest takeaway: the campaign is evolving, and blocking one delivery method will not remove the wider risk.