The Hacker News reports that the threat actor Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
These attacks lead to the deployment of custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell, facilitating interactive remote access to compromised hosts. The targeting is concentrated in Central Asia and the wider CIS region, with victims and lure themes spanning nine countries including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Silent Lynx, active since at least 2020, shares overlaps with other threat clusters like YoroTrooper and ShadowSilk. The infection sequences employ various methods, including macro-enabled Word documents, PS2EXE downloaders, malicious shortcuts within RAR archives, and exploitation of a WinRAR flaw (CVE-2025-8088). The group's sustained activity and adoption of new delivery techniques suggest a continued focus on government organizations, with an interest in intelligence related to regional diplomacy and resource management.
Source: The Hacker News
