Full Report
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives
Analysis Summary
# Threat Actor: Silent Lynx
## Attribution & Identity
* **Actor Name:** Silent Lynx
* **Aliases:** UAT-6275 (Cisco Talos), TAG-193 (Recorded Future), Hydra Saiga, Comrade Saiga.
* **Known Associations/Overlaps:** Assessed as a **Kazakhstan-nexus** threat actor. It shares significant overlaps (TTPs or targeting) with **YoroTrooper** (ShadowSilk, SturgeonPhisher), **Cavalry Werewolf**, and **Tomiris**.
* **Operational History:** Active since at least 2020.
## Activity Summary
Silent Lynx conducted a sustained campaign from June 2025 through August 2026 targeting government entities in the CIS region. The actor utilized four distinct infection chains to deploy custom reverse shells. Recent operations have shown an expansion into exploiting vulnerabilities in perimeter devices (Fortinet) and focusing on critical infrastructure, particularly water resources.
## Tactics, Techniques & Procedures
* **Initial Access:** Spear-phishing emails using compromised government accounts; macro-enabled Word documents; malicious WinRAR archives.
* **Exploitation:** Exploiting **CVE-2025-8088** (WinRAR flaw) and reconnaissance for **CVE-2025-25257** (Fortinet FortiWeb SQL injection).
* **Execution:** PS2EXE (packaging PowerShell as executables); LNK shortcuts; GitHub-hosted PowerShell scripts; Living-off-the-Land (LotL) techniques.
* **Persistence:** Creation of scheduled tasks.
* **C2 & Exfiltration:** Deployment of custom reverse shells for interactive remote access.
* **MITRE ATT&CK IDs:**
* T1566 (Phishing)
* T1204.002 (User Execution: Malicious File)
* T1059.001 (Command and Scripting Interpreter: PowerShell)
* T1053.005 (Scheduled Task/Job: Scheduled Task)
* T1105 (Ingress Tool Transfer)
## Targeting
* **Sectors:** Government, Embassies, Diplomacy, International Trade, Energy, Aviation, Lawyers, Government-backed Banks, Think Tanks, and Water Resource Infrastructure.
* **Geography:** Primarily Central Asia and the Commonwealth of Independent States (CIS). Specific countries include Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
* **Victims:** Armenia’s Ministry of Foreign Affairs, Russia’s Orsk Oil Refinery, and at least 34 other organizations.
## Tools & Infrastructure
* **Custom Malware/Reverse Shells:** FoalShell, Chvost, Laplas, PickleShell.
* **Development Languages:** Rust, Go, Python.
* **Infrastructure:**
* GitHub (hosting PowerShell scripts)
* Compromised government email accounts.
* Staging directories (hosting Linux-compatible tooling).
* *Note:* C2 domains/IPs were not explicitly listed in the text but typically involve compromised web servers or actor-controlled VPS.
## Implications
Silent Lynx represents a sophisticated, persistent regional threat with a clear focus on espionage and potential disruption of critical utilities (water/energy). Their ability to rotate infection chains and adopt new exploits (like the WinRAR and Fortinet flaws) demonstrates high agility. The use of compromised official government accounts for phishing significantly increases the success rate of their social engineering.
## Mitigations
* **Patch Management:** Urgently patch WinRAR (CVE-2025-8088) and Fortinet FortiWeb (CVE-2025-25257) across the enterprise.
* **Email Security:** Implement advanced phishing protection to detect LNK, RAR, and macro-enabled attachments, even from "trusted" external government domains.
* **Host Defense:** Monitor for unauthorized PowerShell execution, especially scripts originating from GitHub or those converted via PS2EXE.
* **Identity Management:** Enforce Multi-Factor Authentication (MFA) to prevent the pivot from compromised accounts.
* **Network Monitoring:** Watch for unusual outbound traffic to GitHub or unknown C2 infrastructure from servers managing critical infrastructure.