Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Cisco Talos tracks a campaign against government organizations across Central Asia and the wider Commonwealth of Independent States (CIS) as UAT-6275. Recorded Future tracks overlapping activity as TAG-193, and the activity is associated with the Silent Lynx name. Talos assesses a Kazakhstan nexus with medium confidence, based on infrastructure access, language artifacts, malware submissions, working-hour patterns and regional targeting. The observed activity ran from June 2025 through August 2026 and introduced four delivery chains, including the first observed use of a vulnerability by the group: a crafted archive exploiting WinRAR CVE-2025-8088.
Who is Silent Lynx?
Silent Lynx is the name used for an intrusion set that overlaps with Cisco Talos’s UAT-6275 tracking and Recorded Future’s TAG-193 designation. The Kazakhstan connection is an assessment, not a confirmed attribution: Talos rates it medium confidence because several independent clues point in that direction, including access to infrastructure, language artifacts, malware submissions, working-hour analysis and regional targeting.
As an Amazon Associate I earn from qualifying purchases.
Talos analyzed 77 GitHub commits and found activity patterns consistent with UTC+3 and UTC+5 working hours. Its assessment is that the operation is persistent and adapting its delivery methods rather than relying on one reusable phishing kit. Talos researcher Ashley Shen described the targeting as concentrated in Central Asia and the wider CIS region.
Recommended Free Tools
“UAT-6275’s sustained activity and adoption of new delivery techniques suggest the group will continue pursuing access to government organizations across Central Asia and the CIS.” — Cisco Talos
Countries and government functions in the crosshairs
Observed victims and lure themes span nine countries:
- Kazakhstan
- Kyrgyzstan
- Tajikistan
- Turkmenistan
- Uzbekistan
- Armenia
- Azerbaijan
- Russia
- Belarus
The campaigns impersonated official communications involving diplomacy, trade, aviation, economic development, agriculture, environmental management, forestry, water resources and energy. Examples include a letter addressed to Armenia’s Ministry of Foreign Affairs, an Uzbekistan Smart Forestry context and a Turkmennebit–Orsk Oil Refinery cooperation proposal. Additional reporting described a Turkmenistan airspace application form and phishing sent from compromised government accounts.
Timeline of the operation
- January 2025: Seqrite first publicly reported Silent Lynx activity.
- June 2025: Talos observed the first of the four chains, using macro-enabled Word documents.
- July 2025: PS2EXE-packaged PowerShell downloaders appeared, followed by reverse shells and scheduled tasks.
- October 2025: Malicious shortcuts inside RAR archives launched PowerShell and retrieved scripts from GitHub.
- Through May 2026: Talos identified at least eight campaigns.
- April 2026: The group first used a vulnerability in an observed delivery chain, exploiting WinRAR CVE-2025-8088.
- August 2026: Talos’s reviewed activity window ends.
How the four attack chains differ
| Chain | Initial delivery | Execution and persistence | User interaction | Vulnerability dependence | Primary controls to monitor |
|---|---|---|---|---|---|
| A | Macro-enabled Word document | Second-stage binary | Open the document and enable macros | None identified | Office spawning interpreters or binaries; macro activity |
| B | PS2EXE-packaged executable downloader | PowerShell fetches a reverse shell; scheduled task provides persistence | Run the executable | None identified | PowerShell downloads and scheduled-task creation |
| C | LNK shortcut inside a RAR archive; later samples retrieved PowerShell from GitHub | PowerShell launches the script; PickleShell is written to the Windows Startup folder in later samples | Open the archive or shortcut | None identified | Archive extraction, LNK execution, public-service downloads and Startup-folder writes |
| D | Crafted RAR archive | WinRAR exploitation writes PickleShell to the Startup folder for execution at the next sign-in | Process the crafted archive | WinRAR CVE-2025-8088 | Archive handling, Startup-folder changes and vulnerable WinRAR installations |
Chain A: macro-enabled documents
The June 2025 chain used Word files with macros as the entry point. Once the recipient opened the document and allowed macro execution, the chain delivered a second-stage binary. This makes Office child-process telemetry and macro policy enforcement important controls even when no software vulnerability is involved.
Chain B: executable PowerShell wrappers
In July 2025, UAT-6275 packaged PowerShell downloaders with PS2EXE. The downloader retrieved reverse-shell components and created scheduled tasks, giving the operator recurring execution after the initial run. Scheduled-task creation tied to a newly launched executable or PowerShell process is a high-value investigation signal.
Rank #3
Chain C: shortcut archives and GitHub retrieval
The October 2025 chain placed malicious LNK files in RAR archives. The shortcut launched PowerShell, which retrieved a script hosted on GitHub. Later samples downloaded PickleShell into the Windows Startup folder, shifting persistence from a task scheduler to execution at user sign-in.
Chain D: the WinRAR CVE-2025-8088 chain
First observed in April 2026, this chain used a crafted RAR to exploit WinRAR CVE-2025-8088 and place PickleShell in the Startup folder. The payload was then positioned to run at the next sign-in. It was the first UAT-6275 delivery chain observed by Talos to weaponize a vulnerability, rather than relying solely on a document, executable, shortcut or script.
Rank #4
What the WinRAR attack means for defenders
- An operator sends a lure containing a specially crafted RAR archive.
- The victim processes the archive with a vulnerable WinRAR installation.
- The archive exploit places PickleShell in the Windows Startup folder.
- At the next sign-in, Windows executes the Startup-folder payload, giving the operator a reverse-shell foothold.
The practical response is to patch WinRAR and other archive utilities throughout the environment, not only on systems used for ordinary file compression. Hunt for archive extraction followed by a new file in a user’s Startup folder, especially when the archive arrived in a government-themed message.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTooling shows broader preparation
Three publicly accessible staging directories and a previously unreported GitHub repository exposed payload builds, tool inventories and command-and-control changes. Talos recovered the Chvost, Laplas and PickleShell reverse shells; corroborating coverage also identified FoalShell. The infrastructure contained Linux-compatible tools and a proof of concept for FortiWeb CVE-2025-25257.
Those artifacts indicate preparation or interest in Linux hosts and internet-facing appliances. They do not establish that UAT-6275 successfully compromised Linux systems or FortiWeb devices. Organizations should therefore treat them as hunting priorities without assuming a breach of those platforms.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Defensive monitoring and response priorities
- Patch archive software: Apply the vendor fix for WinRAR CVE-2025-8088 and keep other archive utilities current. Remove or isolate versions that cannot be patched.
- Watch Office child processes: Alert when Word or another Office application starts PowerShell, a command shell or an unexpected executable, particularly after opening a document received by email.
- Investigate public-service downloads: Review PowerShell reaching GitHub or other public hosting services for scripts or binaries. Validate the destination, signer and parent process rather than blocking all legitimate developer traffic indiscriminately.
- Audit scheduled tasks: Capture task creation, author, trigger, executable path and creation time. A task created by a newly delivered downloader deserves immediate triage.
- Monitor Startup folders: Baseline legitimate files in per-user and common Startup locations and alert on new or modified entries, including files created immediately after archive extraction.
- Inspect archives: Detonate unexpected RAR files and examine their contents and extraction behavior. Treat diplomatic, trade, aviation, forestry, environmental and energy themes as context for verification, not as proof by themselves.
- Use available signatures: Talos lists ClamAV signatures and Snort rules for this activity. Deploy the applicable detections and tune them against known administrative tools and approved automation.
- Check account provenance: Because some phishing was sent from compromised government accounts, verify unusual messages through a separate channel and review authentication logs for the sending account.
What is established—and what is not
The evidence supports a sustained campaign against government organizations in Central Asia and the CIS, with at least eight campaigns identified through May 2026 and four distinct delivery chains. It also shows capability growth from macro documents and executable downloaders to scheduled tasks, public-service script retrieval, Startup-folder persistence and a WinRAR exploit.
Infrastructure artifacts and vulnerability proof-of-concept material broaden the potential threat surface, but they are not proof of successful Linux-host or FortiWeb operations. Attribution to Kazakhstan remains a medium-confidence assessment, and the Silent Lynx label reflects overlap among tracking efforts rather than a universally confirmed identity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
