Silent Lynx Hackers Used WinRAR Flaw to Target CIS Governments

Who is Silent Lynx and Who Was Targeted?

Silent Lynx is a threat group believed to operate from Kazakhstan, active since at least 2020. The group has targeted government organisations across the Commonwealth of Independent States (CIS), which includes countries like Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Previous attacks by Silent Lynx focused on embassies, government-backed banks, lawyers, and think tanks, especially in Kyrgyzstan and Turkmenistan. Security firms Cisco Talos and Recorded Future Insikt Group track this group under the names UAT-6275 and TAG-193, respectively. There is some overlap in tactics with other clusters such as YoroTrooper and Tomiris, but no direct toolset or infrastructure links have been confirmed.The Hacker News↗ (opens in a new tab)

How the Attacks Worked

From June 2025 to August 2026, Silent Lynx ran at least eight campaigns using four main infection methods:

1. Macro-enabled Word documents: In June 2025, the group sent phishing emails with documents containing malicious macros. When opened, these downloaded and ran a second-stage program.
2. PS2EXE downloaders: In July 2025, attackers used PS2EXE, a tool that turns PowerShell scripts into Windows executables, to fetch malware and set up scheduled tasks for persistence.
3. Malicious RAR archives with LNK files: In October 2025, the group sent RAR archives containing a shortcut (LNK file). When clicked, this launched PowerShell to retrieve a script hosted on GitHub, giving the attackers remote access. Later versions also downloaded a custom malware called PickleShell, placing it in the Windows Startup folder to run every time the user logged in.
4. WinRAR vulnerability (CVE-2025-8088): In April 2026, Silent Lynx exploited a flaw in WinRAR to drop PickleShell in the Startup folder. This was the first time the group used a software vulnerability, rather than just social engineering, to deliver malware.

The Tools and Malware Used

Silent Lynx deployed several custom reverse shells, programs that allow attackers to control infected computers remotely. These included FoalShell, Chvost, Laplas, and PickleShell. The group also used public tools and techniques, such as hosting scripts on GitHub and exploiting known vulnerabilities in other software (like Fortinet FortiWeb, CVE-2025-25257). The attackers used official-looking documents as lures, including fake diplomatic letters, airspace application forms, and business proposals related to energy or trade. These were often sent from compromised government email accounts, making the phishing attempts appear more credible.

Motives and Broader Context

According to Cisco Talos, Silent Lynx is interested in agencies related to the environment, economy, and energy infrastructure. This suggests the attacks are focused on gathering intelligence about regional diplomacy and resource management. The group’s activity overlaps with others that have targeted water infrastructure and used a mix of custom malware and "living-off-the-land" techniques (using legitimate tools already present on the system).

What Happens Next and Defensive Steps

The use of a WinRAR vulnerability marks a shift in Silent Lynx’s tactics, showing a willingness to adopt new technical methods. Security researchers believe the group will continue to target government organisations in the region. Defenders should watch for phishing emails with official themes, check for suspicious scheduled tasks, and ensure WinRAR and other software are kept up to date. Monitoring for unusual PowerShell activity and reviewing startup folder contents can also help detect infections. Because the reporting comes from a single source and has not yet been confirmed by vendors or government agencies, organisations should stay alert for further updates and advisories.

Uncertainties and Source Limitations

All information comes from a single report by The Hacker News, citing Cisco Talos and Recorded Future. No primary sources or vendor confirmations are available yet. Details such as the number of affected organisations, the exact impact, and confirmation of the WinRAR vulnerability’s exploitation in the wild remain unverified. Readers should treat these findings as preliminary until more sources confirm them.