A sophisticated cyber espionage campaign by the threat actor Silent Lynx has been identified, targeting government entities within the Commonwealth of Independent States (CIS). This operation, active from June 2025 to August 2026, is marked by the exploitation of a vulnerability in WinRAR, tracked under CVE-2025-8088. The comprehensive attacks involve intricate infection chains, utilizing macro-enabled documents, PS2EXE downloaders, and GitHub-hosted PowerShell scripts to deliver reverse shell malware.
Targeted Attacks Across CIS Region
According to Cisco Talos and Recorded Future Insikt Group, Silent Lynx’s activities are focused primarily on Central Asia, impacting countries such as Kazakhstan, Kyrgyzstan, and Russia. Security researcher Ashley Shen highlighted the use of crafted WinRAR archives to deploy malware like FoalShell, Chvost, and PickleShell, providing remote access to compromised systems. The attacks are part of a broader campaign labeled UAT-6275 and TAG-193, first documented by Seqrite Labs in early 2025, which exposed attacks on various government-backed institutions.
Complex Infection Chains and Techniques
Silent Lynx employs diverse methods to infiltrate systems, including spear-phishing emails with decoy documents related to diplomatic and economic themes. These emails, often appearing legitimate, originate from compromised government accounts. The infection process uses macro-enabled Word documents, PS2EXE-built downloaders, and malicious shortcuts in RAR archives to execute payloads. A notable strategy involved exploiting WinRAR’s CVE-2025-8088 to deploy PickleShell malware, marking a new phase in their delivery techniques.
Potential Expansion and Future Threats
The campaign suggests an evolution in Silent Lynx’s capabilities, potentially expanding their reach by utilizing publicly available exploits for other vulnerabilities, such as CVE-2025-25257 in Fortinet FortiWeb. This indicates a possible broadening of their operational scope. Their interest in sectors like environmental agencies and economic ministries underscores the intelligence value they place on regional resources and diplomacy, suggesting continued activities in these areas.
In conclusion, Silent Lynx’s ongoing operations reflect a persistent threat to CIS governments, with an adeptness for adapting and evolving their cyberattack strategies. As the group continues to refine its methods, heightened vigilance and robust security measures are needed to mitigate their impact on governmental infrastructure.
