Silent Lynx Hits CIS Governments With WinRAR Flaw
Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.
Summary
Silent Lynx (tracked by Cisco Talos as UAT-6275 and by Recorded Future as TAG-193) has been attributed to a series of cyber-espionage attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity was observed from June 2025 through August 2026 and involved four distinct infection chains: macro-enabled Word documents, PS2EXE downloaders, malicious LNK shortcuts that retrieve GitHub-hosted PowerShell scripts, and crafted WinRAR archives that exploit CVE-2025-8088.
Successful infections result in the deployment of custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell, which provide interactive remote access to compromised hosts. Targeting is concentrated in Central Asia and the wider CIS region. Observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The group shows interest in government institutions responsible for diplomacy, economic development, agriculture, environmental management, water resources, and energy.
Background
Silent Lynx was first publicly documented by Seqrite Labs in early 2025. That reporting described attacks against embassies, lawyers, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan. Cisco Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus. Supporting evidence cited by Talos includes Russian-language artifacts, apparent malware-testing submissions from Kazakhstan shortly after compilation, infrastructure access patterns, and operator activity consistent with UTC+5 working hours.
The activity overlaps with clusters previously reported under the names YoroTrooper (also referred to as Comrade Saiga, ShadowSilk, and SturgeonPhisher), Tomiris, Cavalry Werewolf, and Hydra Saiga. Talos states that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster but continues to track them separately because no direct indicator or toolset overlap has been observed between the two.
Spear-phishing emails are frequently sent from compromised government accounts. Identified lure documents include a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery. At least eight campaigns were identified across the region between January 2025 and May 2026. Network flow analysis showed activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026 and a Belarusian government entity ahead of a bilateral meeting in April 2026.
Three publicly accessible staging directories and a previously unreported GitHub repository were identified. These exposed assets provided visibility into payload builds, tool inventories, and changes to command-and-control infrastructure. Linux-compatible tooling and a publicly available proof-of-concept exploit for Fortinet FortiWeb CVE-2025-25257 were also recovered from the actor’s infrastructure. Exploitation of the FortiWeb vulnerability by this group has not been confirmed.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Affected Products | Vulnerability Type |
|---|---|---|---|---|
| CVE-2025-8088 | 8.4 (High) | 94.26% | WinRAR for Windows versions prior to 7.13 (affected ≤ 7.12) | CWE-35: Path Traversal |
CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR. It allows attackers to craft malicious archive files that write files outside the folder chosen for extraction. It was exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog. The issue was fixed in WinRAR version 7.13, released in July 2025.
In the April 2026 infection chain, the crafted RAR archive contains two visible PDF decoys. Hidden payload records abuse NTFS alternate data streams. The path traversal vulnerability allows those records to place the PickleShell executable into the current user’s Startup folder instead of the expected extraction location. This was the first time UAT-6275 was observed using a vulnerability as part of its malware delivery methods.
Attack Methodology
Cisco Talos categorized the recovered samples into four infection chains based on how the payloads are retrieved and executed.
- Chain A (first observed June 2025) – Macro-enabled Word documents download and execute a second-stage binary when macros are enabled.
-
Chain B (first observed July 2025) – Downloaders built with PS2EXE package PowerShell scripts as standalone Windows executables. These downloaders retrieve reverse-shell payloads and create scheduled tasks for persistence. Observed scheduled task names include
WindowsUpdateandMicrosoftOfficeUpdate. - Chain C (first observed October 2025) – A malicious shortcut (LNK) inside a RAR archive launches PowerShell. PowerShell retrieves and executes a GitHub-hosted script that provides remote shell access. Later samples in this chain also download PickleShell and place it in the Windows Startup folder so that it launches automatically at user logon.
-
Chain D (first observed April 2026) – A crafted RAR archive exploits CVE-2025-8088. The archive presents two visible PDF decoys while hidden records that abuse NTFS alternate data streams write PickleShell (observed filename
rnsdtc.exe) directly into%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\. The payload executes at the next user sign-in without requiring elevated privileges.
The custom reverse shells recovered include FoalShell, Chvost, Laplas, and PickleShell. PickleShell is a C#/.NET reverse shell. A stable metadata GUID (be3a4a59-ef3d-4e1c-9501-b5f40be09217) was identified across nine analyzed PickleShell samples. The group also used public services such as GitHub to host malicious scripts and payloads.
Indicators of Compromise
Key infrastructure
| Indicator | Role |
|---|---|
104[.]248[.]17[.]222 |
Publicly accessible staging directory |
62[.]113[.]66[.]137 |
Publicly accessible staging directory |
154[.]205[.]145[.]179 |
Publicly accessible staging directory |
45[.]130[.]146[.]197 |
PickleShell control endpoint |
geoanswer[.]ru:8443 |
Compromised-host control endpoint used for PowerShell reverse shell |
licensing-mp-microsoft[.]serveexchange[.]com |
Laplas control domain |
46[.]243[.]186[.]87:51512 |
Earlier Chvost control endpoint |
178[.]128[.]40[.]89:8989 |
Macro payload download host (Chain A) |
xzj4 / GoBuster7777 |
GitHub accounts used for script and payload staging |
Key file hashes (SHA-256)
| SHA-256 | Label |
|---|---|
4627cc970b2af15a292e0286820ccec069507c827810b839e1c532a03206353c |
Crafted RAR archive exploiting CVE-2025-8088 |
392b70086f10c23ce7b4173d1f68d72727ea0146260fb773c78642f6eb641775 |
PickleShell payload delivered through the WinRAR attack |
cedc4ec0c238b1fc7a71dfa54f7d2d407539d22b87fe1c73b96b7a0dc17d4e40 |
Macro-enabled Word document (Chain A) |
d12eef4b4b57c0186a166afc6246bf7fb4f668d0a84348c076c4943af1c98838 |
China–Central Asia Summit campaign sample |
036a60aa2c62c8a9be89a2060e4300476aef1af2fd4d3dd8cac1bb286c520959 |
PS2EXE downloader associated with targeting Turkmenistan |
a38af45a67fc9070d46649feab0b347011585d1e547fe88185e70dea6e6582ea |
Reverse-shell sample classified as Chvost |
6806029ed72de2b592c18edb430ffabd56137a8428b7c23860ae4f000a02f0af |
Early Chvost sample compiled in June 2022 |
Behavioral indicators
| Value | Description |
|---|---|
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ |
Destination used for PickleShell persistence |
rnsdtc.exe |
PickleShell executable filename dropped by the crafted archive |
be3a4a59-ef3d-4e1c-9501-b5f40be09217 |
Stable PickleShell metadata GUID found across nine analyzed samples |
WindowsUpdate / MicrosoftOfficeUpdate |
Scheduled task names created by Chain B downloaders |
456.ps1 |
GitHub-hosted PowerShell reverse shell |
%TEMP%\update.exe |
Local destination used by the analyzed macro downloader |
Cross-check domains, IPs, URLs, and hashes against the Cisco Talos IOC repository before blocking or hunting at scale.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic ID | Tactic |
|---|---|---|---|
| T1566.001 | Phishing: Spearphishing Attachment | TA0001 | Initial Access |
| T1204.002 | User Execution: Malicious File | TA0002 | Execution |
| T1059.001 | Command and Scripting Interpreter: PowerShell | TA0002 | Execution |
| T1203 | Exploitation for Client Execution | TA0002 | Execution |
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | TA0003 | Persistence |
| T1053.005 | Scheduled Task/Job: Scheduled Task | TA0003 | Persistence |
| T1105 | Ingress Tool Transfer | TA0011 | Command and Control |
| T1071.001 | Application Layer Protocol: Web Protocols | TA0011 | Command and Control |
Visual Attack Flow
High-level path from delivery through espionage objectives, based on the four infection chains described in public research.
Mitigation
- Update all WinRAR installations to version 7.13 or later to remediate CVE-2025-8088. WinRAR does not auto-update.
- Audit the Windows Startup folder (
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\) and scheduled tasks for unexpected executables or scripts, particularly after users open RAR archives. - Monitor for PowerShell processes that download and execute content from public code-hosting services such as GitHub.
- Block and hunt network traffic using the indicators in this article and the full set in the Cisco Talos IOC repository.
- Treat RAR and other archive attachments received from external or government-looking senders with caution. Prefer opening such archives in isolated environments.
- Review Linux hosts and internet-facing appliances for unexpected tooling, given that Linux-compatible binaries and a FortiWeb proof-of-concept were found on actor infrastructure. Keep Fortinet FortiWeb and similar appliances patched against known vulnerabilities including CVE-2025-25257.
- Cisco Talos published ClamAV signatures for this threat, including detections for PickleShell, Chvost, and Laplas. Organizations using ClamAV or Snort should ensure the relevant signatures and rules are enabled.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated solution that helps you quickly remediate risks, including critical third-party application and CMS updates. It supports Windows, Linux, macOS, and 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
