Silent Lynx Targets CIS Governments via WinRAR Exploit

• •Silent Lynx has targeted CIS government organizations using a WinRAR exploit.
• •The campaign has been active from June 2025 to August 2026, affecting nine countries.
• •CVE-2025-8088 is actively exploited, enabling remote access via custom reverse shells.

The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating remote access. The campaigns have affected entities in nine countries, including Kazakhstan, Kyrgyzstan, and Russia, with phishing emails containing decoy documents related to diplomatic and trade matters. Silent Lynx, first reported in 2025, is believed to be linked to broader operations targeting critical infrastructure in Central Asia. Cisco Talos and Recorded Future are tracking these activities under the identifiers UAT-6275 and TAG-193. The threat actor has been active since at least 2020 and is suspected to have connections with other clusters like YoroTrooper. As of now, the exploitation of the WinRAR flaw is confirmed in the wild.