The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).

The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.

The attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded Future Insikt Group, which are tracking the campaign under the monikers UAT-6275 and TAG-193.

"UAT-6275's targeting is concentrated in Central Asia, and the wider CIS region," security researcher Ashley Shen said. "Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."

Silent Lynx was first publicly documented by Seqrite Labs in early 2025, highlighting the threat actor's attacks on embassies, lawyers, government-backed banks, and think tanks across Kyrgyzstan and Turkmenistan.

It's assessed to be a Kazakhstan-nexus threat actor active since at least 2020, sharing overlaps with other clusters codenamed YoroTrooper (aka Comrade Saiga, ShadowSilk, and SturgeonPhisher), ShadowSilk, Cavalry Werewolf, and Tomiris.

It's suspected that both UAT-6275 and YoroTrooper are part of the same broader activity cluster, although no direct indicator or toolset overlap has been observed between the two.

Earlier this year, VMRay disclosed that a threat cluster it tracks as Hydra Saiga compromised at least 34 organizations across 8 countries since December 2024, with reconnaissance efforts extending to over 200 additional targets across the world.

Source link