Full Report
Introduction Timeline Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings. Technical Analysis. Campaign – I The LNK Way. Malicious SILENT LOADER Malicious LAPLAS Implant – TCP & TLS. Malicious .NET Implant – SilentSweeper Campaign – II Malicious .NET Implant – SilentSweeper VBScript. Malicious PowerShell Script. Hunting and Infrastructure. Attribution Early-Remediations. Conclusion SEQRITE Protection. […] The post Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to Dushanbe appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Threat Actor: Silent Lynx
## Attribution & Identity
**Identified By:** Seqrite Labs’ APT Team (first to assign the nomenclature "Silent Lynx").
**Known Aliases:** YoroTrooper, Sturgeon Phisher, Cavalry Werewolf, ShadowSilk, and UNG0002 (implied via associated research).
**Known Associations:** The threat group has been identified by multiple other research vendors under various names.
## Activity Summary
Silent Lynx is an Advanced Persistent Threat (APT) group known for orchestrating spear-phishing campaigns, often impersonating government officials to target government employees. Recent campaigns tracked by Seqrite focus heavily on espionage related to geopolitical events and diplomatic relations in Central Asia, specifically linking to activity clustered around Dushanbe.
* **Campaign I (Early June-September):** Targeted Chinese & Central Asian governmental think-tanks using the theme of a summit held in Astana, Kazakhstan.
* **Mid-September to October Campaign:** Abused emails from Kyrgyzstan-based governmental entities to target various entities within Russia.
* **Recent/Ongoing Campaign:** Targeted entities involved in Azerbaijan-Russian diplomacy, using themes related to events in **Dushanbe** (e.g., meetings involving Strategic Co-operation keywords).
* **General Focus:** Espionage done in a "hasty manner," often resulting in operational security (OPSEC) blunders that aid detection.
## Tactics, Techniques & Procedures
The actor utilizes a mix of custom and readily available open-source offensive tooling.
- **Initial Access/Delivery:** Spear-phishing combined with lure documents (specifically mentioned: **fake RAR archives**).
- **Staging/Execution:** Deployed various stagers/loaders across campaigns, indicating a sluggish shift in methods (e.g., shifting between different delivery mechanisms).
- **Malware Families Used (Specific to Campaigns):**
* **SILENT LOADER** (used in Campaign I).
* **LAPLAS Implant** (communicates via TCP & TLS, used in Campaign I).
* **.NET Implant – SilentSweeper** (used across both Campaign I and II).
* **VBScript** (used in Campaign II).
* **PowerShell Script** (used in Campaign II).
- **Campaign Structure:** Campaigns are characterized by evolving implant deployment across two major tracked phases (Campaign I and Campaign II).
## Targeting
**Sectors:**
* Government Think-tanks & Diplomats.
* Mining Industry.
* Transport & Communication Industry.
* National Banks and Railway Projects (mentioned in earlier tracking from Nov 2024).
**Geography:**
* Tajikistan (recent focus/shift to Dushanbe).
* Azerbaijan (entities involved in diplomacy with Russia).
* Russia (entities targeted via Kyrgyzstan lures).
* China.
* Other Central-Asian nations (Kyrgyzstan, Turkmenistan, Uzbekistan).
**Victims:** Entities involved in geopolitical and diplomatic relationships across the Russia-Central Asian axis.
## Tools & Infrastructure
- **Malware Families Used:** SILENT LOADER, LAPLAS Implant, SilentSweeper (.NET Implant).
- **Infrastructure:** The research covered the infrastructure across multiple identified campaigns, though specific C2 details or defanged IOCs are not detailed in this summary context excerpt.
## Implications
The primary and sole purpose of the group is **espionage**. Their focus on governmental entities and diplomatic relationship themes (Astana Summit, Dushanbe diplomatic events) suggests intelligence gathering related to high-level political and strategic cooperation within Central Asia. The actor's tendency toward hasty execution results in OPSEC blunders, suggesting potential avenues for disruption and tracking.
## Mitigations
- Awareness of spear-phishing lures, particularly those tied to regional diplomatic events (summits, strategic cooperation announcements).
- Monitoring for the delivery of LNK files or fake archives used for initial compromise.
- Detecting the deployment and communication patterns associated with the LAPLAS implant (TCP/TLS) and the SilentSweeper implant.
- Implementing hunting measures targeting VBScript and PowerShell execution chains associated with the observed campaigns.