Silent Lynx Hackers Use WinRAR Flaw and Fake Documents to Target Central Asian Governments

A threat actor known as Silent Lynx has been tied to a fresh set of attacks on government organisations across the Commonwealth of Independent States (CIS). Cisco Talos and Recorded Future Insikt Group, which track the campaign as UAT-6275 and TAG-193, say the activity ran from June 2025 through August 2026. Victims and lure themes span nine countries, including Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.

The attackers used four different infection chains. These involve macro-enabled documents, downloaders built with PS2EXE, PowerShell scripts hosted on GitHub, and specially crafted WinRAR archives that exploit the vulnerability CVE-2025-8088. Each path leads to custom reverse shells named FoalShell, Chvost, Laplas and PickleShell, which give attackers interactive remote access to compromised computers.

Silent Lynx was first publicly documented by Seqrite Labs in early 2025, after attacks on embassies, lawyers, government-backed banks and think tanks. It is assessed to be a Kazakhstan-nexus actor active since at least 2020, with overlaps to clusters such as YoroTrooper and Tomiris. Researchers suspect UAT-6275 and YoroTrooper belong to the same broader activity cluster, though no direct tool overlap has been seen. The campaign targets government bodies in Central Asia, but the techniques it uses, such as booby-trapped documents and archives, are common tools that any organisation could face.