Researchers Identify Silent Lynx Campaigns Targeting Russian Energy and Government Sectors

Researchers from Cisco Talos and Recorded Future have published a detailed analysis of Silent Lynx, a threat actor likely based in Kazakhstan. The group conducts persistent espionage campaigns across Central Asia, targeting high-value public sector organizations within the Commonwealth of Independent States since at least 2024.

The report identifies specific recent targets, including the Orsk Oil Refinery in southern Russia and the government of Nizhny Novgorod. The refinery sits approximately 25 kilometers from the Kazakhstan border. Nizhny Novgorod is located about 425 kilometers east of Moscow, near a vital waterway system connected to the Caspian Sea, which holds strategic importance for Kazakhstan.

Operational Tactics and Tools

Silent Lynx employs a deliberately lightweight toolkit to maintain a low profile. The group uses PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, and commodity tunneling tools. They stage malware on trusted public services such as GitHub and hijacked legitimate servers to increase credibility and infection success rates.

The actors send spear-phishing emails through compromised government email accounts in Tajikistan and Kyrgyzstan. This technique adds legitimacy to their communications. The researchers note that the lack of technically flashy methods has allowed the group to remain active for years without significant public attention.

Historical Context and Attribution

The group overlaps significantly with previously documented clusters known as YoroTrooper, ShadowSilk, and Hydra Saiga. Cisco Talos tracks the activity as UAT-6275, while Recorded Future labels it TAG-193. These aliases point to the same underlying operational pattern across the region.

This reporting builds on earlier findings regarding the group’s methods. As Threat Times reported on October 15, 2026, Silent Lynx previously used a WinRAR flaw and custom reverse shells in campaigns targeting CIS governments from June 2025 to August 2026. The current analysis expands the scope to include energy sector targets in Russia.

What should you do?

Organizations in Central Asia and the CIS region should monitor for suspicious email activity originating from compromised government accounts. Security teams should inspect PowerShell execution logs for unusual reverse shell connections. Administrators should verify the legitimacy of files hosted on public staging platforms like GitHub before execution.

What to do and how to stay safe: Silent Lynx

• Monitor email gateways for phishing attempts originating from compromised government accounts in Tajikistan and Kyrgyzstan.
• Inspect PowerShell logs for connections to external servers that do not match known administrative patterns.
• Verify the integrity of files downloaded from public repositories such as GitHub before allowing execution.
• Review firewall rules to detect and block unauthorized outbound connections from commodity tunneling tools.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is Silent Lynx?

Silent Lynx is a Kazakhstan-linked threat actor also known as UAT-6275 and TAG-193, conducting espionage in Central Asia.

What are their main targets?

The group targets government ministries, diplomatic missions, civil society organizations, and energy entities like the Orsk Oil Refinery.

How do they deliver malware?

They use spear-phishing emails sent from compromised government accounts and stage malware on trusted services like GitHub.