The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).
The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
The attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded Future Insikt Group, which are tracking the campaign under the monikers UAT-6275 and TAG-193.
“UAT-6275’s targeting is concentrated in Central Asia, and the wider CIS region,” security researcher Ashley Shen said. “Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.”
Silent Lynx was first publicly documented by Seqrite Labs in early 2025, highlighting the threat actor’s attacks on embassies, lawyers, government-backed banks, and think tanks across Kyrgyzstan and Turkmenistan.
It’s assessed to be a Kazakhstan-nexus threat actor active since at least 2020, sharing overlaps with other clusters codenamed YoroTrooper (aka Comrade Saiga, ShadowSilk, and SturgeonPhisher), ShadowSilk, Cavalry Werewolf, and Tomiris.
It’s suspected that both UAT-6275 and YoroTrooper are part of the same broader activity cluster, although no direct indicator or toolset overlap has been observed between the two.
Earlier this year, VMRay disclosed that a threat cluster it tracks as Hydra Saiga compromised at least 34 organizations across 8 countries since December 2024, with reconnaissance efforts extending to over 200 additional targets across the world.
It’s worth noting that both Comrade Saiga and Hydra Saiga refer to the same threat actor. The “hydra” prefix in the tracking alias is a reference to the adversary’s heavy focus on breaching infrastructure linked specifically to water resources in Central Asia using a mix of custom implants written in Rust, Go, and Python and Living-off-the-Land techniques.
Attack chains mounted by the threat actor involve the use of spear-phishing emails containing diplomatic relations, international trade, energy, and aviation-themed decoy documents. No less than eight campaigns have been identified across the region between January 2025 and May 2026.
The phishing emails are sent from compromised government accounts and make use of official-looking documents to lend the social engineering attack a veneer of credibility. “Identified lures included a diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery,” Recorded Future said.
What’s more, three publicly accessible staging directories linked to the threat actor have been found to host Linux-compatible tooling and a publicly available proof-of-concept exploit for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb, suggesting a possible expansion of the threat actor’s operational capabilities.
Infection sequences have been found to employ four different pathways –
- June 2025 – Using macro-enabled Word documents to download and run a second-stage binary.
- July 2025 – Using downloaders built with PS2EXE, a tool that packages PowerShell scripts as Windows executables, to fetch reverse-shell payloads and create scheduled tasks for persistence.
- October 2025 – Using a malicious shortcut (LNK) within a RAR archive to launch PowerShell responsible for retrieving and executing a GitHub-hosted script that provides remote shell access. Subsequent iterations also download PickleShell and stage it in the Windows Startup folder so that it’s automatically launched every time a user logs in to the system.
- April 2026 – Using a RAR archive that exploits a WinRAR flaw (CVE-2025-8088) to drop PickleShell in the Windows Startup folder.
The April 2026 infection chain marks the first time UAT-6275 has weaponized a security flaw as part of its malware delivery methods.
“UAT-6275’s sustained activity and adoption of new delivery techniques suggest the group will continue pursuing access to government organizations across Central Asia and the CIS,” Talos said. “Its interest in environmental agencies, economic ministries, and energy infrastructure reflects the intelligence value of regional diplomacy and resource management.”
