Ethical Hacking News
The Silent Lynx threat actor has been linked to a series of high-profile incidents targeting government organizations across the CIS. The attacks, which have been observed since June 2025, have been attributed to the group's exploitation of a previously unknown vulnerability in WinRAR, as well as the use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and custom crafted WinRAR archives. The group's attacks have been characterized by their use of spear-phishing emails, custom reverse shells, and a focus on breaching environmental agencies, economic ministries, and energy infrastructure. The threat actor's use of a WinRAR flaw marks a significant departure from its previous attack methods, suggesting a continued commitment to evolving its TTPs to evade detection and achieve its objectives.
Silent Lynx, a sophisticated threat actor, has been linked to high-profile attacks on government organizations in the CIS region.The attacks use various tactics, including exploitation of a previously unknown WinRAR vulnerability and macro-enabled documents.Silent Lynx has targeted government organizations in nine countries, including Kazakhstan, Russia, and Belarus.The group's attacks involve the deployment of custom reverse shells and spear-phishing emails with decoy documents.The Silent Lynx threat actor is believed to be a Kazakhstan-nexus threat actor active since at least 2020.The group's attacks have been characterized by their use of multiple pathways, including PS2EXE downloaders and GitHub-hosted PowerShell scripts.The Silent Lynx threat actor's evolution in tactics and techniques suggests continued commitment to evasion and objectives.The group's focus on breaching infrastructure linked to water resources in Central Asia highlights the complexity of its operations.
Silent Lynx, a threat actor known for its sophisticated cyber espionage and malware attacks, has recently been linked to a series of high-profile incidents targeting government organizations across the Commonwealth of Independent States (CIS). The attacks, which have been observed since June 2025, have been attributed to the group's exploitation of a previously unknown vulnerability in WinRAR, a popular file archiver software, as well as the use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and custom crafted WinRAR archives.
According to cybersecurity researchers, Silent Lynx has been actively targeting government organizations in nine countries, including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The group's attacks have been observed to involve the deployment of custom reverse shells, such as FoalShell, Chvost, Laplas, and PickleShell, which facilitate interactive remote access to compromised hosts.
The attacks, which have been tracked under the monikers UAT-6275 and TAG-193, have been characterized by their use of spear-phishing emails containing diplomatic relations, international trade, energy, and aviation-themed decoy documents. The emails are sent from compromised government accounts and are designed to lend a veneer of credibility to the social engineering attack.
The Silent Lynx threat actor is believed to be a Kazakhstan-nexus threat actor that has been active since at least 2020. The group's attacks have been linked to other clusters codenamed YoroTrooper, ShadowSilk, Cavalry Werewolf, and Tomiris. It is suspected that both UAT-6275 and YoroTrooper are part of the same broader activity cluster, although no direct indicator or toolset overlap has been observed between the two.
The attacks, which have been observed to involve the use of four different pathways, have been characterized by their use of macro-enabled Word documents to download and run a second-stage binary, PS2EXE downloaders to fetch reverse-shell payloads and create scheduled tasks for persistence, GitHub-hosted scripts to retrieve and execute a PowerShell script responsible for retrieving and executing a reverse shell, and RAR archives that exploit a WinRAR flaw to deploy a custom reverse shell.
The Silent Lynx threat actor's use of a WinRAR flaw, which was previously unknown, marks a significant departure from its previous attack methods. The group's decision to weaponize this vulnerability suggests a continued commitment to evolving its tactics, techniques, and procedures (TTPs) to evade detection and achieve its objectives.
The attacks, which have been observed to be concentrated in Central Asia and the wider CIS region, have been characterized by their use of environmental agencies, economic ministries, and energy infrastructure as targets. The group's interest in these sectors reflects the intelligence value of regional diplomacy and resource management.
According to cybersecurity researchers, the Silent Lynx threat actor's sustained activity and adoption of new delivery techniques suggest that the group will continue to pursue access to government organizations across Central Asia and the CIS. The group's focus on breaching infrastructure linked to water resources in Central Asia using a mix of custom implants written in Rust, Go, and Python and Living-off-the-Land techniques further highlights the complexity and sophistication of its operations.
In conclusion, the Silent Lynx threat actor's recent attacks on CIS government organizations highlight the ongoing threat landscape in the region. The group's use of sophisticated TTPs, including the exploitation of a previously unknown WinRAR flaw, underscores the importance of staying vigilant and proactive in the face of evolving threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Silent-Lynx-A-Threat-Actors-Rise-to-Prominence-in-Cyber-Espionage-and-Malware-Attacks-on-CIS-Government-Organizations-ehn.shtml
https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html
https://cybersecuritynews.com/tomiris-hacker-group-added-new-tools/
https://www.cybersecurity-review.com/tomiris-wreaks-havoc-new-tools-and-techniques-of-the-apt-group/
Published: Thu Oct 15 17:38:30 2026 by llama3.2 3B Q4_K_M
