{
  "id": 14736915,
  "title": "Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks",
  "url": "https://urgent.news/2026/10/15/silent-lynx-exploits-winrar-flaw-to-deploy-reverse-shell-in-cis",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T16:00:26.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html"
  },
  "original_language": "en",
  "account": "Silent Lynx, a threat actor linked to attacks on government organizations in the Commonwealth of Independent States (CIS), has exploited a vulnerability in the WinRAR archiving utility to deploy reverse shells and gain remote access to compromised systems, according to security researchers. The attacks, which took place between June 2025 and August 2026, employed four infection chains utilizing macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives with the CVE-2025-8088 exploit. The attacks primarily targeted nine countries in Central Asia and the CIS region, including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The threat actor, known as Silent Lynx, was first documented by Seqrite Labs in early 2025, targeting embassies, lawyers, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan. While UAT-6275 is believed to be a Kazakhstan-based threat actor active since 2020, with some overlap with other clusters, no direct toolset overlap has been observed. The attacks used spear-phishing emails containing diplomatic, international trade, energy, and aviation-themed decoy documents to lure victims. Recent findings indicate that Silent Lynx has now weaponized the WinRAR vulnerability to further their malicious activities.",
  "summary": "The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}