Silent Lynx APT New Attack Targeting Governmental Employees Posing as Officials

Seqrite Labs’ APT Team has documented fresh campaigns from Silent Lynx, a sophisticated threat actor group known for orchestrating spear-phishing operations that impersonate government officials to target diplomatic and governmental employees across Central Asia. The group, also tracked under aliases including YoroTrooper, Sturgeon Phisher, and Cavalry Werewolf, continues its espionage-focused activities with minimal operational security improvements, leaving researchers with clear attribution indicators.

The latest campaigns, collectively dubbed Operation Peek-A-Baku, demonstrate Silent Lynx’s persistent interest in monitoring geopolitically sensitive events and have targeted entities involved in Azerbaijan-Russia relations, China-Central Asian diplomatic initiatives, and cross-border infrastructure projects in 2025.

Deceptive tactics involve malicious RAR archives with filenames mirroring legitimate government documents, with one October 2025 campaign using a file named План развитие стратегического сотрудничества.pdf[.]rar containing malicious LNK shortcuts. Upon execution, the LNK files exploit PowerShell to download and run scripts from GitHub, including a GoBuster777 repository, and establish a TCP-based reverse shell connecting to 206.189.11[.]142:443. 5 November 2025.