Kazakhstan-linked Silent Lynx exploits WinRAR flaw against CIS governments
Cisco Talos and Recorded Future say a suspected Kazakhstan-linked group targeted government bodies in nine former Soviet states and began exploiting WinRAR flaw CVE-2025-8088.
At a glance
- Cisco Talos (UAT-6275) and Recorded Future (TAG-193) link at least eight campaigns since January 2025 to a suspected Kazakhstan-linked group.
- Targets include government bodies in nine countries, including Armenia, Belarus, Tajikistan, Uzbekistan and Russia.
- In April 2026 the group exploited WinRAR flaw CVE-2025-8088 to plant a reverse shell in the Windows Startup folder, its first observed use of a vulnerability.
- Phishing emails were sometimes sent from compromised government accounts and used diplomatic, aviation and energy lures.
A cyber-espionage group assessed to have ties to Kazakhstan has targeted government organizations across nine former Soviet states and, for the first time, exploited a software vulnerability to deliver malware, according to reports from Cisco Talos and Recorded Future's Insikt Group published on October 15, 2026. The Hacker News identifies the actor as Silent Lynx, which Talos tracks as UAT-6275 and Insikt Group as TAG-193.
What happened
According to The Record, researchers assessed with medium confidence that the group has ties to Kazakhstan, citing Russian-language material in its malware, samples tested from Kazakhstan soon after creation, and activity matching Kazakhstan's working hours. The Hacker News reports overlaps with clusters known as YoroTrooper, ShadowSilk, Cavalry Werewolf and Tomiris, although Talos said it had not observed direct indicator or toolset overlaps with YoroTrooper.
The Record says the researchers tied at least eight campaigns since January 2025 to the group, targeting or showing interest in government institutions in nine countries. The Hacker News lists Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Focus areas include foreign affairs, economic development, agriculture, environmental management, and energy and water resources. Examples cited by The Record include a Tajik government entity shortly after March 2026 treaty talks with Kazakhstan and an Armenian environmental agency.
"These organizations hold information that can inform negotiations, economic planning, and regional security decisions," Insikt Group said, as quoted by The Record.
Technical details
The group relies on spear-phishing, sometimes sent from compromised legitimate government accounts, with lures such as diplomatic correspondence, aviation forms and business proposals, according to both publications. The Hacker News describes infection chains evolving from macro-enabled Word documents in June 2025 to PS2EXE downloaders, LNK files inside RAR archives that pull scripts from GitHub, and custom reverse shells named FoalShell, Chvost, Laplas and PickleShell.
In April 2026, the group used a RAR archive exploiting WinRAR flaw CVE-2025-8088 to drop PickleShell into the Windows Startup folder, so it runs at sign-in. The Record says this was likely aimed at Armenia's Ministry of Foreign Affairs. The Hacker News adds that researchers found staging directories hosting a public proof-of-concept for Fortinet FortiWeb flaw CVE-2025-25257, suggesting possible expansion of the group's capabilities.
What to do
The reports do not include specific defensive guidance. Based on the techniques described:
- Update WinRAR to a version that fixes
CVE-2025-8088and patch FortiWeb againstCVE-2025-25257. - Monitor for LNK and PowerShell abuse, new scheduled tasks and files dropped in Startup folders.
- Treat unexpected archive attachments from government or partner accounts with caution, since the group uses compromised legitimate mailboxes.
- Consult the Talos and Recorded Future reports for indicators of compromise.
Related CVEs
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
