Ethical Hacking News
Uncovering the Shadows of Silent Lynx: A Kazakhstan-Linked Cyber Threat Actor Targeting Russian Energy and Government Entities
A group of hackers linked to Kazakhstan has been identified as a significant threat actor targeting Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future have uncovered a link between the group, known as Silent Lynx, and a Ukrainian drone attack on the Orsk Oil Refinery. With its growing sophistication and targeting of critical energy infrastructure, Silent Lynx is a notable example of the evolving threat landscape in the region. Stay up-to-date with the latest developments in the world of cyber security by subscribing to our newsletter and following us on Twitter, Facebook, and Mastodon.
Silent Lynx, a group of hackers likely based in Kazakhstan, is targeting Russian energy and government entities in espionage campaigns. The group's toolkit consists of PowerShell-based reverse shells, proprietary shells, and spear phishing emails. Silent Lynx's operational sloppiness inadvertently revealed its connection to Kazakhstan, including leaving open directories exposed on public servers. The group's targeting of Russian energy infrastructure, particularly the Orsk Oil Refinery, has significant implications. The discovery of Silent Lynx highlights the growing threat of cyber espionage from smaller countries with serious geopolitical interests.
Silent Lynx, a group of hackers likely based in Kazakhstan, has been identified as a significant threat actor targeting Russian energy and government entities in espionage campaigns across Central Asia. According to researchers from Cisco Talos and Recorded Future, Silent Lynx, also known as UAT-6275 and TAG-193, has been conducting targeted intrusion campaigns against government bodies, diplomatic missions, and civil society organizations across Central Asia since at least 2024.
The group's toolkit is deliberately lightweight, consisting of PowerShell-based reverse shells, proprietary shells written in C++, C#, and Go, commodity tunneling tools, and spear phishing emails sent through compromised government email accounts in Tajikistan and Kyrgyzstan. GitHub, Telegram, and hijacked legitimate servers serve as staging platforms for the group's operations. The researchers found that Silent Lynx's operational sloppiness, including leaving open directories exposed on public servers and staging payloads, inadvertently revealed the group's connection to Kazakhstan.
The researchers highlighted several indicators that suggest a Kazakhstan-based origin, including the fact that the group's servers were accessed from ProtonVPN egress IPs geolocated to Kazakhstan, exclusively on weekdays between 7 AM and noon local time. Additionally, two malware samples uploaded to VirusTotal from Kazakhstan within minutes of compilation demonstrated classic anti-detection testing behavior, pointing to the operator location directly.
Silent Lynx's sophistication has grown over time, with the group using an exploit for the first time in April 2026 to deliver malware. It abused a WinRAR path traversal flaw (CVE-2025-8088) to place malicious files directly in the Windows Startup folder, without requiring victims to enable macros. The group also stored a public proof of concept for a FortiWeb authentication bypass vulnerability on its own command-and-control (C2) server.
The researchers noted that Silent Lynx's targeting of Russian energy infrastructure, particularly the Orsk Oil Refinery, has significant implications. The group may have been assessing the economic impact of the Ukrainian drone attack in August 2025, which forced the refinery to shut down for months. This context could be interpreted as the group attempting to understand how the disruption might affect Kazakhstan's own export pipelines.
The discovery of Silent Lynx highlights an important point: cyber espionage is no longer the domain of a few major powers. Smaller countries are also developing their capabilities and running long-term operations against neighboring states, often driven by serious geopolitical interests.
The full joint Virus Bulletin paper with full indicators of compromise, malware hashes, and infrastructure details is available for download. For more information on Silent Lynx and its activities, please visit the Security Affairs website.
Related Information:
https://www.ethicalhackingnews.com/articles/Uncovering-the-Shadows-of-Silent-Lynx-A-Kazakhstan-Linked-Cyber-Threat-Actor-Targeting-Russian-Energy-and-Government-Entities-ehn.shtml
https://securityaffairs.com/201003/apt/silent-lynx-kazakhstan-linked-hackers-target-russian-refinery-and-government.html
https://nvd.nist.gov/vuln/detail/CVE-2025-8088
https://www.cvedetails.com/cve/CVE-2025-8088/
Published: Thu Oct 15 18:06:36 2026 by llama3.2 3B Q4_K_M
