Silent Lynx Hackers Target Central Asian Governments via Phishing

• •Silent Lynx has targeted Central Asian governments since at least 2024 using spear-phishing.
• •The group exploited a vulnerability in WinRAR, affecting unpatched systems despite a patch being released.
• •Investigations revealed exposed tools and infrastructure, aiding in tracking their operations.

Silent Lynx, a hacking group reportedly operating from Kazakhstan, has been targeting Central Asian government agencies since at least 2024. They utilized compromised official email accounts to launch spear-phishing attacks, including sending malicious attachments disguised as legitimate communications. The group has been linked to data exfiltration efforts, focusing on ministries involved in regional diplomacy and natural resources. Recent investigations revealed that they left attack tools exposed online, including a GitHub repository that provided insights into their operations. Notably, one attack exploited a vulnerability in WinRAR, which had a patch released in July 2025, but could still affect systems. The group has also been associated with a broader threat cluster known as ShadowSilk, which has been active since 2023. As of October 2026, their activities continue to evolve, with new infrastructure and tactics being observed.