Cybersecurity
Silent Lynx uses WinRAR flaw in CIS government attacks
Cisco Talos and Recorded Future Insikt Group said the threat actor Silent Lynx ran four intrusion chains from June 2025 to August 2026 against government targets across the CIS, including one using CVE-2025-8088.
- Cisco Talos and Recorded Future Insikt Group said they tracked the activity as UAT-6275 and TAG-193.
- They said the campaign ran from June 2025 through August 2026 and used four delivery paths.
- The payloads included FoalShell, Chvost, Laplas and PickleShell, which provided interactive remote access.
- Ashley Shen said the observed victims and lure themes covered nine countries, including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.
- Talos said the April 2026 WinRAR chain was the first time UAT-6275 had weaponised a vulnerability in its delivery methods.
Cisco Talos and Recorded Future Insikt Group said Silent Lynx had been behind a campaign against government organisations in Central Asia and the wider CIS. They tracked the activity as UAT-6275 and TAG-193.
The activity was said to have run from June 2025 to August 2026. The operators used macro documents, PS2EXE downloaders, PowerShell scripts hosted on GitHub and RAR archives built around CVE-2025-8088 in WinRAR.
Talos said the infections dropped custom reverse shells including FoalShell, Chvost, Laplas and PickleShell. Those tools gave operators remote access to compromised systems, and one April 2026 chain placed PickleShell in the Windows Startup folder.
Ashley Shen said the victims and lure themes spanned nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Talos also said the April 2026 chain was the first time UAT-6275 had used a security flaw as part of its delivery method.
Named in this story
People
- Ashley Shen
- Security researcher quoted on the victim countries
Organisations
- Silent Lynx
- The threat actor attributed with the campaign
- Cisco Talos
- Tracked the activity and described the intrusion chains
- Recorded Future Insikt Group
- Co-tracked the campaign and named it TAG-193
- Seqrite Labs
- First publicly documented Silent Lynx in early 2025
- VMRay
- Disclosed the Hydra Saiga cluster in earlier reporting
- UAT-6275
- Talos's alias for the campaign
- TAG-193
- Recorded Future's alias for the campaign
- Hydra Saiga
- VMRay's cluster name for related activity
Products and systems
- WinRAR
- Its flaw was used in one delivery chain
- Fortinet FortiWeb
- Was targeted by a proof-of-concept exploit found in staging directories
- PS2EXE
- Was used to package PowerShell scripts as Windows executables
- FoalShell
- One of the reverse shells deployed
- Chvost
- One of the reverse shells deployed
- Laplas
- One of the reverse shells deployed
- PickleShell
- One of the reverse shells deployed
Places
- Commonwealth of Independent States
- The wider region targeted by the attacks
- Central Asia
- The main area of concentration for the campaign
How the source tells it
The source was a sober threat-intelligence report that relied on attribution and technical description rather than emotive framing.
No emotive framing was found in the original.