Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Silent Lynx, a threat actor linked to attacks on government organizations in the Commonwealth of Independent States (CIS), has exploited a vulnerability in the WinRAR archiving utility to deploy reverse shells and gain remote access to compromised systems, according to security researchers. The attacks, which took place between June 2025 and August 2026, employed four infection chains utilizing macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives with the CVE-2025-8088 exploit.

The attacks primarily targeted nine countries in Central Asia and the CIS region, including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The threat actor, known as Silent Lynx, was first documented by Seqrite Labs in early 2025, targeting embassies, lawyers, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan.

While UAT-6275 is believed to be a Kazakhstan-based threat actor active since 2020, with some overlap with other clusters, no direct toolset overlap has been observed. The attacks used spear-phishing emails containing diplomatic, international trade, energy, and aviation-themed decoy documents to lure victims. Recent findings indicate that Silent Lynx has now weaponized the WinRAR vulnerability to further their malicious activities.