Break Silence Tracking Silent Lynx Through Exposed Infrastructure

Silent Lynx is a persistent threat actor conducting targeted intrusion campaigns against government ministries, diplomatic missions, and civil society organizations across Central Asia since at least 2024. The group maintains a strong focus on high-value public sector organizations in the Commonwealth of Independent States (CIS), frequently leveraging spear-phishing campaigns conducted through compromised government email accounts and on malware staging through trusted public services such as GitHub to increase credibility and infection success rates.

This talk delivers a deep technical analysis of Silent Lynx's operations and infrastructure evolution from late 2024 through 2026. We detail newly uncovered infrastructure components leveraged in previously undisclosed activities, including exposed open directories, newly registered DDNS domains, and a GitHub repository associated with an operator-controlled persona, providing new visibility into the group's staging workflows, malware delivery chain and tooling development practice. In addition, we examine elements of higher-tier management infrastructure, shedding light on how the group may orchestrate campaigns and maintain control across a distributed operational environment.

We further analyse newly identified tools, payloads, and TTPs, illustrating how Silent Lynx continues to iterate on its intrusion lifecycle to evade detection and improve operational resilience. Notably, we observe an expanding focus on Linux-based systems, signalling broadening targeting strategy. This evolution is accompanied by evidence suggesting interest in exploiting vulnerabilities such as Fortinet CVE-2025-25257, alongside the adoption of new techniques and multilingual artifacts that offer clues into the group's operational maturity and possible origins. Throughout the presentation, we explore the enduring attribution challenges surrounding Silent Lynx and the potential overlapping with YoroTrooper, highlighting the increasingly blurred boundaries between threat clusters in this space. We conclude with an assessment of the group's trajectory and provide practical detection and hunting guidance for defenders seeking to identify, attribute, and disrupt these evolving operations.

Download paper for this talk

Julian-Ferdinand Vögele

Julian-Ferdinand is a principal threat researcher at Recorded Future's Insikt Group, specialising in malware analysis and infrastructure detection. He investigates cybercriminal, state- , and mercenary spyware operations. He previously worked in offensive security, studied computer science, and is a Virtual Routes fellow.

Chi-en Shen (Ashley) is a security researcher at Cisco Talos, specializing in emerging threats including APTs, financially motivated crimes, spyware, and mercenary group exploitation. Previously, she worked at Google Threat Analysis Group focusing on zero-day exploit hunting and botnet tracking, and at Mandiant tracking APT groups across APAC. Passionate supporting women in InfoSec, she co-founded HITCON GIRLS, Taiwan's first security community for women, and organizes Rhacklette in Switzerland. She serves on the review boards for Black Hat Asia, Hack in the Box, and HITCON, and has spoken at Black Hat, HITCON, FIRST, and CODE BLUE.

@ashl3y-shen.bsky.social

Back to VB2026 Programme page

Back to VB2026 conference page

Threat intelligence-driven clustering: identifying a new cyber-mercenary intrusion set

From hotel account compromise to guest payment fraud: the reservation hijack attack chain

Hunting LANDFALL: from overlooked images to state-linked mobile spyware

Gorbag: Orcs at the border

Defeating indirect branching obfuscations in malware with Hex-Rays Decompiler

Discerning the invisible: a heuristic engine for behavioural inference in nation-state covert networks

Kimwolf’s claws loom over 1.8 million firewalled Android devices worldwide

Paying the TOLL: how REF3927 turned 571 IIS servers into an SEO fraud network

Leveraging Landlock telemetry for Linux detection engineering

Targeting the elderly: from spoofing to persistence

The invisible warzone: competing botnets fighting over your smart TV

Mac&Cheese: cooking up the Digit Stealer recipe

How real-world malware disables EDR systems

Newsjacking the world: tracking three months of uncovered APT operations disguised as global headlines

Polling is the vulnerability: a case for event-driven cloud detection

The edge is the enemy: hunting Chinese router relay networks

Unravelling Lumma Stealer’s protection stack: pushing static deobfuscation to its practical limit

AI in malware: evolution and predicting the future of AI-driven attacks

The cyber saga: deconstructing the DPRK’s global synthetic IT workforce ecosystem

Tracing the bloodline of LLM-driven polymorphic malware: do GHOSTs leave footprints?

How LOLRMM, LOLDrivers and CertGraveyard map the attacker's favourite kill chain

Agent detection and response: safety on a token budget

Malwaremorphosis - breaking down a global multi-layer malvertising operation

I will find you and I will flag you: hunting malicious packages at scale

Otter encyclopaedia: deep analysis of Otter family

Break the silence: tracking Silent Lynx through exposed infrastructure

Operation FalseProof: PoC that bites back

Transparency wars: exposing hidden biases in testing

Snap, trigger, steal: SnappyClient and the art of trigger-based intrusions

Reverse engineering a multi-stage implant targeted Vietnamese organizations

When malware talks back: real-time interaction with a threat actor during the analysis of Kiss Loader

Free games, costly consequences: unravelling PiviGames’ hidden treasure malware

Khmer Shadow: uncovering a targeted cyber espionage campaign against Cambodian military intelligence

Practical ransomware detection on macOS (via maths, not AI)

From exclusive to widespread: the shifting exploitation dynamics of (zero-day) vulnerabilities before and after their (public) disclosure

The other side of the front: hunting Paper Werewolf's operations against Russia

Meet ARES - an agentic reverse engineer that decrypts sophisticated ransomware encrypted files

Disrupting the threat actor mythos: data-based insights into targeting, tooling, and the limits of AI in cybercrime

Iberian Deception: Phishing Campaigns Targeting Tax and Traffic Authorities in Portugal and Spain

When wipers leave backups: an analysis of ArgonWiper’s encryption workflow

Notoriously reluctant: continuing conversations with FBI and private sector defenders disrupting cybercriminals through collaboration

From dead malware to living adversaries: AI-powered digital twins for adaptive APT modelling

The silent threat in your enterprise: SAP security

BEAST: binary emulation and analysis simulation technology for advanced malware analysis and anti-forensic countermeasures

Spec-driven malware: turning markdown into threats

The invisible candidate: tracking the evolution of 'Un-tracked' GRITCASPIAN

DPRK-aligned threat operations: tradecraft, tooling, and detection patterns

Workshop: Collaborative attack modelling across CTI, Red Team, and SOC (MITRE)

TIPS: The chapter

TIPS: Collaboration in action: turning shared threat intelligence into coordinated defence

TIPS: From signal to shield: rapid collaboration to defend critical infrastructure during crisis

TIPS: Harmonizing AI agents and human analysts in CTI - are CTI agents friends or rivals to junior analysts?

TIPS: Stairway to resilience: cybersecurity in good times, bad times, and everything between

TIPS: Defending (against) the human layer: IoB in the real world

TIPS: STIX in action: proposed industry collaboration on sharing DigSig metadata

TIPS: Ghosts in the chat: tracking GhostPairing from trusted message to linked-device takeover

TIPS: The art of fighting back

TIPS: Wartime intelligence collection and collaboration

Setting off into the wild blue yonder

Operation RikiBox: the new threat actor with two novel persistence mechanisms

Hidden in the overlay - analysis of a backdoor leveraging encrypted overlay communications for ORB

Under the surface: inside the evolving 10FXRAT campaign

After the wipe: runtime root-secret recovery from JadePuffer/ ENCFORGE on Windows

From seed to branch: inside DarkPlum's expansion to Ukraine

Operation ASTERIX: software developer by day, crypto scammer by night

Manufactured credibility: detecting fabricated Git history in an active software supply chain Campaign

Dawn of Ninja Era: unmasking a malware distribution campaign linked to DPRK IT workers network

Ghost in the webmail: how TA488 learned to haunt your inbox

Inside a Sandworm attack: UAC-0099 access and a Yggdrasil-backed backdoor

Inside Popa: a day in the life of a residential proxy

TIPS: From strategic collections to global and multifaceted ransomware response

Partner presentation: Gulp: exploring and overcoming the limits of modern DFIR

Seeing through a straw: when the threat is bigger than your data