The threat actor known as **Silent Lynx** has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). Observed from June 2025 through August 2026, the activity involves four distinct infection chains. These chains exploit macro-enabled documents, **PS2EXE** downloaders, **GitHub**-hosted **PowerShell**, and meticulously crafted **WinRAR** archives that leverage the vulnerability **CVE-2025-8088**. These attacks ultimately lead to the deployment of custom reverse shells such as **FoalShell**, **Chvost**, **Laplas**, and **PickleShell**. These tools facilitate interactive remote access to compromised hosts, as reported by **Cisco Talos** and **Recorded Future Insikt Group**, who are tracking the campaign under the monikers **UAT-6275** and **TAG-193** respectively. "**UAT-6275**'s targeting is concentrated in Central Asia, and the wider CIS region," noted security researcher Ashley Shen. "Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus." **Silent Lynx** was first publicly documented by **Seqrite Labs** in early 2025, detailing the threat actor's attacks on embassies, legal firms, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan. ### Overlaps with Other Threat Clusters Assessed as a Kazakhstan-nexus threat actor active since at least 2020, **Silent Lynx** shows overlaps with other clusters including **YoroTrooper** (also known as **Comrade Saiga**, **ShadowSilk**, and **SturgeonPhisher**), **ShadowSilk**, **Cavalry Werewolf**, and **Tomiris**. While direct indicators or toolset overlaps haven't been observed, both **UAT-6275** and **YoroTrooper** are suspected to be part of the same broader activity cluster. Earlier this year, **VMRay** disclosed that a threat cluster it tracks as **Hydra Saiga** compromised at least 34 organizations across 8 countries since December 2024. Reconnaissance efforts extended to over 200 additional targets globally.  It's worth noting that **Comrade Saiga** and **Hydra Saiga** refer to the same threat actor. The "hydra" prefix references the adversary's strong focus on breaching infrastructure related to water resources in Central Asia, employing a mix of custom implants written in **Rust**, **Go**, and **Python**, alongside Living-off-the-Land techniques. ### Attack Chain Details Attack chains mounted by the threat actor involve spear-phishing emails containing diplomatic relations, international trade, energy, and aviation-themed decoy documents. No less than eight campaigns have been identified across the region between January 2025 and May 2026. The phishing emails originate from compromised government accounts and utilize official-looking documents to add credibility to the social engineering attack. "Identified lures included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery," **Recorded Future** stated. Furthermore, three publicly accessible staging directories linked to the threat actor have been discovered. These directories host Linux-compatible tooling and a publicly available proof-of-concept exploit for **CVE-2025-25257**, an SQL injection flaw in **Fortinet FortiWeb**, suggesting a potential expansion of the threat actor's operational capabilities. Infection sequences have been found to employ four distinct pathways: * **June 2025**: Using macro-enabled **Word** documents to download and execute a second-stage binary. * **July 2025**: Utilizing downloaders built with **PS2EXE**, a tool that packages **PowerShell** scripts as **Windows** executables, to fetch reverse-shell payloads and create scheduled tasks for persistence. * **October 2025**: Employing a malicious shortcut (**LNK**) within a **RAR** archive to launch **PowerShell**, which retrieves and executes a **GitHub**-hosted script for remote shell access. Subsequent iterations also download **PickleShell** and stage it in the **Windows Startup** folder for automatic launch upon user login. * **April 2026**: Using a **RAR** archive that exploits a **WinRAR** flaw (**CVE-2025-8088**) to drop **PickleShell** directly into the **Windows Startup** folder. The April 2026 infection chain marks the first instance of **UAT-6275** weaponizing a security flaw as part of its malware delivery methods. "**UAT-6275**'s sustained activity and adoption of new delivery techniques suggest the group will continue pursuing access to government organizations across Central Asia and the CIS," **Talos** concluded. "Its interest in environmental agencies, economic ministries, and energy infrastructure reflects the intelligence value of regional diplomacy and resource management."