-
The group Silent Lynx, identified as UAT-6275 and TAG-193, has mainly affected government entities in Central Asia and the CIS.
-
The gang employed various tactics to infiltrate their victims, such as spear-phishing, PowerShell, GitHub-placed scripts, and exploiting CVE-2025-8088 through WinRAR – to install reverse shells.
-
Organizations are advised to patch WinRAR and FortiWeb, check PowerShell activities, and be alert to any changes on the Startup folder.
Cybersecurity analysts have established a connection between the Silent Lynx threat group and recent attacks on government establishments within the Commonwealth of Independent States (CIS) – these attacks took place between June 2025 and August 2026.
The group used four distinct methods to inject malware. These methods included macro-enabled files, PS2EXE downloaders, hosted PowerShell on GitHub, and modifying WinRAR archives.
Who Silent Lynx Targets
Cisco Talos tracks the group as UAT-6275. Recorded Future’s Insikt Group tracks the same activity as TAG-193.
The group has its major focus on Central Asia and the CIS region. Further, researchers noted their victims and the lure themes they used across nine countries – including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
Further, reports linked Silence Lynx to attacks against embassies and law offices, government-affiliated banks, and research centers. The group has reportedly been involved in attacks taking place in Kyrgyzstan and Turkmenistan.
Additionally, the researchers suspect that the group is based in Kazakhstan because of the language used, reliable infrastructure access, the random samples it provided, and the operating hours of its members.
The group may also overlap with YoroTrooper, ShadowSilk, Cavalry Werewolf, Tomiris, and Hydra Saiga. However, researchers have not found direct evidence that UAT-6275 and YoroTrooper share the same tools.
How the Attacks Start
The attackers distribute spear-phishing emails to officials. These messages incorporate some significant-looking official files on international relations, commerce, energy as well as aviation. The attackers send many emails from compromised government accounts. This makes the messages look more trustworthy.
Compromised government email accounts can also create opportunities for further abuse. In a separate case, hackers allegedly offered access to government email accounts on a dark web marketplace.
Researchers found lures that copied real documents. One lure was a diplomatic letter for Armenia’s Ministry of Foreign Affairs. Another lure was a Turkmenistan airspace application form. A third was a business proposal involving the Orsk Oil Refinery in Russia.
Cisco Talos found at least eight campaigns between January 2025 and May 2026. The campaigns targeted governments, environmental agencies, economic ministries, and energy infrastructure.
Four Infection Chains
The first chain started functioning in June 2025. It utilized macro-enabled Word documents for downloading and executing its second-stage binary.
The second chain emerged in July last year. It made use of PS2EXE downloaders to convert PowerShell scripts into Windows executable files. These downloaders acquired payloads that featured reverse shells. They created scheduled tasks to maintain the functioning of the malware after the operating system reboot.
The third chain came into view in October 2025. It employed a harmful LNK shortcut within a RAR package. The shortcut launched PowerShell. PowerShell then downloaded and ran a script hosted on GitHub.
Later versions of this chain downloaded PickleShell. The malware placed PickleShell in the Windows Startup folder. This allowed PickleShell to run each time a user logged into the computer. The technique gave the attackers persistent access to the system.
Use of the WinRAR Flaw
The fourth chain appeared in April 2026. It used a RAR archive to exploit CVE-2025-8088, a WinRAR vulnerability. The exploit placed PickleShell in the Windows Startup folder. The malware then ran when the user next signed in.
This was the first time researchers saw UAT-6275 use a security flaw in its malware delivery. The change shows that the group is improving its attack methods. The attacks deployed custom reverse shells, including FoalShell, Chvost, Laplas, and PickleShell. A reverse shell gives an attacker interactive remote access to an infected computer.
Researchers also found Linux-compatible tools on the group’s infrastructure. They also found a proof-of-concept exploit for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb. These findings suggest that Silent Lynx may expand its attacks. It may target Linux systems and internet-facing devices in future campaigns.
How Organizations Can Respond
Government bodies in Central Asia and the CIS should update WinRAR and other archive tools. They should also patch Fortinet FortiWeb systems where needed. Security teams should monitor unusual PowerShell activity. They should also watch for downloads from GitHub and changes to scheduled tasks.
Organizations should block unexpected changes to the Windows Startup folder. They should also train staff to avoid opening attachments from unknown or suspicious senders. The researchers say Silent Lynx will likely continue targeting government organizations. Its interest in diplomacy, water resources, and energy shows the value of regional intelligence.
