Silent Lynx Uses WinRAR Flaw and Reverse Shells in CIS Government Campaign

Cisco Talos and Recorded Future Insikt Group attribute a series of espionage attacks against Commonwealth of Independent States governments to the threat actor Silent Lynx. The campaign, tracked as UAT-6275 and TAG-193, ran from June 2025 through August 2026 and utilized a newly discovered vulnerability in WinRAR to establish persistent remote access on compromised Windows systems.

The attackers deployed four distinct infection chains involving macro-enabled documents, PS2EXE downloaders, PowerShell scripts hosted on GitHub, and malicious WinRAR archives. These methods exploited CVE-2025-8088 to install custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell. These tools provided the threat actors with interactive remote control over victim machines, facilitating further espionage activities across the region.

Threat Actor Background and Connections

Silent Lynx was first publicly documented by Seqrite Labs in early 2025, which highlighted attacks on embassies, legal firms, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan. Analysts assess the group to be a Kazakhstan-nexus actor active since at least 2020. The group shares operational overlaps with clusters codenamed YoroTrooper, ShadowSilk, Cavalry Werewolf, and Tomiris, suggesting a complex ecosystem of related threat activities.

Researchers suspect UAT-6275 and YoroTrooper belong to the same broader activity cluster, although no direct indicator or toolset overlap has been observed between them. This assessment aligns with earlier reporting by Threat Times on October 15, 2026, which noted that hackers exploiting the same WinRAR flaw were conducting espionage campaigns against CIS governments using GitHub-hosted scripts.

Targeting and Infrastructure Focus

The campaign’s targeting is concentrated in Central Asia and the wider CIS region. According to security researcher Ashley Shen, victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The spear-phishing emails contained decoy documents themed around diplomatic relations, international trade, energy, and aviation to lure recipients into executing the malicious payloads.

VMRay disclosed earlier this year that a related cluster, Hydra Saiga, compromised at least 34 organizations across eight countries since December 2024. Reconnaissance efforts extended to over 200 additional targets globally. Both Comrade Saiga and Hydra Saiga refer to the same threat actor, with the "hydra" prefix referencing a heavy focus on breaching water resource infrastructure in Central Asia using custom implants written in Rust, Go, and Python.

What should you do?

Security teams should monitor for unusual PowerShell execution and connections to known GitHub repositories used for hosting malicious scripts. Administrators should review logs for the deployment of custom reverse shells such as FoalShell or PickleShell, which may appear as legitimate system processes. Organizations should verify the integrity of WinRAR installations and ensure they are updated to versions that address CVE-2025-8088 once a patch is available.

What to do and how to stay safe: Silent Lynx

• Inspect email attachments for macro-enabled documents and disable macros by default in office applications to prevent initial execution.
• Monitor network traffic for outbound connections to unexpected GitHub repositories or domains hosting PowerShell scripts, which may indicate data exfiltration or command-and-control activity.
• Audit system processes for unknown reverse shells or custom implants written in languages like Rust, Go, or Python that do not match known software inventories.
• Implement application whitelisting to prevent the execution of unauthorized PS2EXE downloaders or other binary converters that may be used to bypass security controls.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which vulnerability did Silent Lynx exploit in WinRAR?

The threat actor exploited CVE-2025-8088, a flaw in WinRAR that allowed them to deploy reverse shells on compromised Windows systems.

What countries were targeted in this campaign?

The campaign targeted government organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

Is Silent Lynx related to other known threat groups?

Yes, Silent Lynx shares overlaps with YoroTrooper, ShadowSilk, Cavalry Werewolf, and Tomiris, and is suspected to be part of the same cluster as UAT-6275.