Silent Lynx Adds WinRAR Exploit to CIS Government Campaigns

Silent Lynx, a threat actor tracked by Cisco Talos as UAT-6275 and by Recorded Future Insikt Group as TAG-193, has used the WinRAR flaw CVE-2025-8088 to deliver the PickleShell reverse shell to government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and included four distinct infection chains.

The April 2026 operation used a crafted RAR archive to exploit CVE-2025-8088 and place PickleShell in the Windows Startup folder. That mechanism makes the malware launch when a user signs in. Talos and Recorded Future describe this as the first observed occasion on which UAT-6275 weaponized a security vulnerability in its malware-delivery process.

Four routes to interactive access

The campaigns ultimately deploy custom reverse shells, including FoalShell, Chvost, Laplas and PickleShell. These tools provide interactive remote access on compromised machines, while the delivery methods have changed over time.

• In June 2025, macro-enabled Microsoft Word documents downloaded and ran a second-stage binary.
• In July 2025, PS2EXE-built downloaders fetched reverse-shell payloads and created scheduled tasks for persistence.
• In October 2025, a malicious LNK file in a RAR archive launched PowerShell to retrieve and execute a GitHub-hosted script. Later variants also downloaded PickleShell into the Windows Startup folder.
• In April 2026, a RAR archive exploiting CVE-2025-8088 dropped PickleShell into that Startup folder.

PS2EXE packages PowerShell scripts as Windows executables, giving the actor another way to conceal script-based download activity within a familiar file format. The LNK and archive-based approaches likewise rely on users opening deceptive attachments before the remote-access component is retrieved or installed.

Government lures and regional targeting

Researchers identified no fewer than eight campaigns across the region between January 2025 and May 2026. Observed victims and lure themes span Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. The actor’s targeting is concentrated in Central Asia and the broader CIS region.

Spear-phishing emails use diplomatic relations, international trade, energy and aviation themes. They are sent from compromised government accounts and carry official-looking documents, a combination intended to make the social-engineering approach appear credible. Identified examples included a diplomatic letter for Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form and a business proposal concerning Russia’s Orsk Oil Refinery.

Silent Lynx was first publicly documented by Seqrite Labs in early 2025 in attacks against embassies, lawyers, government-backed banks and think tanks in Kyrgyzstan and Turkmenistan. It is assessed to be a Kazakhstan-nexus actor active since at least 2020, with reported overlaps to clusters including YoroTrooper, ShadowSilk, Cavalry Werewolf and Tomiris. Researchers suspect UAT-6275 and YoroTrooper may belong to a broader activity cluster, but have not observed a direct indicator or toolset overlap.

Potentially broader operational toolkit

Three publicly accessible staging directories tied to the actor contained Linux-compatible tooling and a public proof-of-concept for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb. The finding suggests a possible expansion of its operational capabilities, although the reported attacks focus on the Windows-based infection chains described above.

For organizations in the region, the practical priority is to patch vulnerable WinRAR installations and treat archive attachments, shortcut files, macro-enabled documents and unexpected PowerShell activity as related investigation signals. Monitoring Windows Startup-folder modifications and newly created scheduled tasks can also help teams identify the persistence methods used in these campaigns.