A cyber espionage group known as Silent Lynx has been linked to a new wave of attacks targeting government organizations across Central Asia and the wider Commonwealth of Independent States (CIS). The campaign uses multiple infection techniques, including malicious Office documents, PowerShell-based downloaders, GitHub-hosted scripts, and specially crafted WinRAR archives that exploit a known security vulnerability.
The activity, observed between June 2025 and August 2026, has been attributed to threat clusters tracked by Cisco Talos as UAT-6275 and by Recorded Future’s Insikt Group as TAG-193. Researchers identified four distinct infection chains designed to deploy custom reverse-shell malware, including FoalShell, Chvost, Laplas, and PickleShell.
These tools provide attackers with interactive remote access to compromised systems, potentially enabling persistent surveillance, reconnaissance, and further operations against government networks.
According to security researcher Ashley Shen, the group’s targeting is concentrated in Central Asia and the broader CIS region. The campaigns reviewed by researchers involved victims or decoy themes associated with nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
Silent Lynx: Background and Suspected Affiliations
Silent Lynx was first publicly documented by Seqrite Labs in early 2025. The initial reporting described attacks against embassies, legal professionals, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan.
Researchers assess that the group has links to Kazakhstan and has been active since at least 2020. Its activity has been associated with several other tracked threat clusters, including YoroTrooper, also known as Comrade Saiga, ShadowSilk, and SturgeonPhisher, as well as Cavalry Werewolf and Tomiris.
Researchers suspect that UAT-6275 and YoroTrooper may belong to a broader activity cluster. However, they have not identified direct overlaps in indicators of compromise or tooling that would conclusively establish a connection.
Earlier in 2026, VMRay reported that a threat cluster it tracks as Hydra Saiga had compromised at least 34 organizations across eight countries since December 2024. The group had also conducted reconnaissance against more than 200 additional targets worldwide.
Comrade Saiga and Hydra Saiga refer to the same threat actor. The Hydra Saiga designation reflects the group’s reported focus on infrastructure associated with water resources in Central Asia.
Its operations have involved custom malware written in Rust, Go, and Python, alongside living-off-the-land techniques that abuse legitimate system utilities to conduct malicious activities while attempting to avoid detection.
Spear-Phishing Emails Use Diplomatic and Energy-Themed Decoys
Silent Lynx relies heavily on spear-phishing emails designed to appear relevant to government officials and other high-value targets.
The messages use decoy documents associated with diplomatic relations, international trade, energy, and aviation. By imitating legitimate government correspondence or business communications, the attackers attempt to persuade recipients to open malicious attachments or files.
Recorded Future identified at least eight campaigns across the region between January 2025 and May 2026.
The phishing emails were reportedly sent from compromised government accounts, making them more credible to recipients familiar with the supposed senders.
Examples of identified lures included:
- A diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs.
- A Turkmenistan airspace application form.
- A business proposal concerning Russia’s Orsk Oil Refinery.
The use of compromised official accounts increases the likelihood that recipients will trust the messages. It also allows attackers to exploit existing relationships and legitimate communication channels rather than relying exclusively on newly created phishing accounts.
Researchers Discover Additional Exploitation Infrastructure
Investigators also identified three publicly accessible staging directories associated with the threat actor.
The directories contained tools compatible with Linux systems and a publicly available proof-of-concept exploit for CVE-2025-25257, a SQL injection vulnerability affecting Fortinet FortiWeb.
The presence of this exploit suggests that the group’s infrastructure may support a wider range of offensive capabilities beyond the Windows-focused infection chains described in the campaign.
However, the availability of a proof-of-concept exploit does not, by itself, establish that Silent Lynx successfully exploited the vulnerability in an actual intrusion.
Four Infection Chains Used to Deploy Custom Reverse Shells
Cisco Talos and Recorded Future identified four distinct infection pathways associated with the campaign. The techniques evolved over time, culminating in the use of a WinRAR vulnerability to deliver malware.
1. June 2025: Malicious Word Documents
The earliest infection chain identified in this set used macro-enabled Microsoft Word documents.
When triggered, the malicious macros downloaded and executed a second-stage binary, giving the attackers a pathway to establish a foothold on the victim’s system and deploy additional tools.
This technique relies on social engineering to convince recipients to open the document and enable or execute its active content.
2. July 2025: PowerShell Downloaders Packaged as Executables
In July 2025, the attackers adopted downloaders built with PS2EXE, a utility that converts PowerShell scripts into Windows executables.
These downloaders retrieved reverse-shell payloads and created scheduled tasks to maintain persistence.
A reverse shell allows an attacker to interact with a compromised machine remotely by establishing a connection through which commands can be sent and responses returned.
Packaging the PowerShell functionality as an executable can also make the malicious activity less immediately apparent to users who do not inspect the binary.
3. October 2025: Malicious Shortcuts and GitHub-Hosted Scripts
The October 2025 infection chain used a malicious Windows shortcut file, or LNK, embedded in a RAR archive.
Opening the shortcut launched PowerShell, which retrieved and executed a script hosted on GitHub. The script provided remote shell access to the compromised system.
In later iterations, the attackers also downloaded PickleShell and placed it in the Windows Startup folder. This allowed the malware to launch automatically when a user logged in, helping the attackers maintain access across subsequent sessions.
Using a legitimate hosting platform to deliver scripts can complicate detection because the network traffic may resemble ordinary developer or software-related activity.
4. April 2026: WinRAR Vulnerability Exploited to Deliver PickleShell
The April 2026 infection chain introduced a significant change: the use of a security vulnerability in WinRAR to deliver the malware.
The attackers created a specially crafted RAR archive that exploited CVE-2025-8088 to drop PickleShell into the Windows Startup folder.
This marked the first identified instance in which UAT-6275 weaponized a software vulnerability as part of its malware delivery process.
The shift from phishing documents and scripted downloaders to vulnerability exploitation indicates that the group has diversified its methods for gaining access to target systems.
Organizations using affected WinRAR versions should ensure that the software is updated and that suspicious archives are handled with appropriate security controls.
Custom Malware Enables Persistent Remote Access
The four infection chains ultimately deploy custom reverse-shell tools, including FoalShell, Chvost, Laplas, and PickleShell.
These tools give operators interactive access to compromised hosts, supporting remote command execution and additional post-compromise activities.
The use of multiple payloads and delivery mechanisms gives the threat actor flexibility when targeting different environments or adapting to defensive measures.
Persistence techniques, such as creating scheduled tasks or placing malware in the Windows Startup folder, can also allow the attackers to regain access after users log in or systems restart.
For government organizations, these capabilities present a significant risk because compromised endpoints may provide access to sensitive communications, internal documents, and systems used to manage diplomatic, economic, or infrastructure-related operations.
Government and Critical Infrastructure Organizations Remain at Risk
Cisco Talos warned that Silent Lynx’s sustained activity and adoption of new delivery techniques suggest the group will likely continue pursuing government organizations across Central Asia and the wider CIS region.
Researchers also highlighted the group’s interest in environmental agencies, economic ministries, and energy infrastructure, where access to internal information could support intelligence collection.
The combination of targeted phishing, custom malware, persistence mechanisms, and vulnerability exploitation demonstrates the importance of layered security controls.
Government agencies and other potentially affected organizations should prioritize the following measures:
- Patch vulnerable software: Update WinRAR and other exposed applications to versions that address known security flaws, including CVE-2025-8088.
- Strengthen email security: Filter suspicious attachments, block malicious macros where possible, and train employees to recognize unexpected diplomatic or business-themed messages.
- Monitor PowerShell activity: Investigate unusual script execution, unexpected downloads from code-hosting platforms, and suspicious command-line activity.
- Inspect persistence mechanisms: Review scheduled tasks and Windows Startup folders for unfamiliar or unauthorized entries.
- Monitor outbound connections: Look for unusual network activity associated with reverse shells, unexpected remote-access sessions, and connections to suspicious infrastructure.
- Protect government accounts: Enforce multi-factor authentication, monitor unusual sign-ins, and investigate suspected account compromise.
- Hunt for compromise: Use endpoint detection and response tools to investigate suspicious archives, malicious shortcuts, unexpected executables, and signs of unauthorized remote access.
Conclusion
The Silent Lynx campaign highlights the evolving tactics of a suspected Kazakhstan-linked cyber espionage actor targeting government organizations across Central Asia and the CIS.
By combining spear-phishing, PowerShell-based downloaders, GitHub-hosted scripts, and exploitation of a WinRAR vulnerability, the group has developed several pathways for deploying custom reverse-shell malware and maintaining access to compromised systems.
The adoption of CVE-2025-8088 exploitation in April 2026 is particularly notable because it represents the first identified use of a software vulnerability in the group’s malware delivery chain.
With government institutions, diplomatic organizations, and resource-related agencies remaining among the campaign’s targets, defenders should prioritize software patching, email security, endpoint monitoring, and proactive threat hunting to reduce the risk of compromise.
