SILENT Lynx has been linked to a new wave of attacks against government organisations across the CIS, with activity spanning from June 2025 to August 2026. The group employs four parallel infection chains that hinge on macro-enabled Office documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
The operations culminate in the deployment of custom reverse shells—FoalShell, Chvost, Laplas, and PickleShell—that provide interactive remote access to compromised hosts. Security firms Cisco Talos and Recorded Future Insikt Group track the campaigns under the identifiers UAT-6275 and TAG-193, and note a regional concentration in Central Asia and the wider CIS, with victims across nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.
The attacks build on Silent Lynx’s long‑running campaign history, including prior activity linked to embassies, lawyers, government-backed banks and think tanks in Kyrgyzstan and Turkmenistan. The operation shows overlap with clusters known as YoroTrooper, ShadowSilk, Cavalry Werewolf and Tomiris, though no direct toolset overlap has been observed. Notably, April 2026 marks the first instance of UAT-6275 weaponising a security flaw as part of its delivery chain.
Evidence includes four infection sequences, including a June 2025 macro attack, a July 2025 PS2EXE downloader approach, a October 2025 LNK in a RAR to fetch a GitHub script, and an April 2026 RAR‑based exploit dropping PickleShell in the Startup folder. Additional indicators point to staging directories hosting Linux tooling and a public PoC for CVE-2025-25257 (Fortinet FortiWeb SQL injection), suggesting potential expansion of capabilities.