Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Summary: Silent Lynx, tracked by Cisco Talos as UAT-6275 and by Recorded Future as TAG-193, ran attacks on CIS government organizations from June 2025 through August 2026 using four infection chains: macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088. The campaigns deployed custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell, with victims and lure themes spanning nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
What's compelling: The April 2026 chain was the first time this group weaponized a vulnerability for delivery, and three public staging directories were found hosting Linux tooling and a proof-of-concept for a Fortinet FortiWeb SQL injection flaw - a signal the toolset is widening beyond the nine countries already hit.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-25257CVE-2025-8088
- Related