Operation Peek-A-Baku: Silent Lynx APT Exploits LNK Flaws to Deploy Reverse Shells via GitHub Against Central Asian Diplomacy

Seqrite Labs’ APT Team has released a detailed report on Operation Peek-A-Baku, identifying the threat actor Silent Lynx as behind a series of LNK-based exploits used to deploy reverse shells via GitHub against Central Asian diplomacy targets. The campaigns, running between June and October 2025, targeted China–Central Asia diplomatic summits, Russia–Azerbaijan meetings, and government and infrastructure entities in Tajikistan, Azerbaijan, Russia, and China.

Phishing employed RAR archives masquerading as summit documents that contained a malicious LNK file abusing PowerShell to fetch a payload from a GitHub repository known as GoBuster777_, which decodes to a quick TCP-based reverse shell connecting to 206.189.11[.]142:443.

Silent Lynx deployed several interlinked implants, including Silent Loader, Laplas (TCP and TLS variants), and SilentSweeper, with the latter capable of extracting embedded PowerShell payloads and creating a scheduled task for persistence in at least one campaign. The researchers traced C2 activity to Russia and the Netherlands, and linked campaigns through shared infrastructure and metadata, noting a recurring preference for Base64 encoding and reverse shells in PowerShell, C++, Golang and .NET.

Seqrite warned that Silent Lynx may widen its focus to upcoming India–Central Asia summits, though no campaigns had been observed at publication.