Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

A Kazakhstan-linked espionage group tracked as Silent Lynx, also known as UAT-6275 or TAG-193, has been hitting government bodies across Central Asia and the wider CIS since June 2025, according to Cisco Talos and Recorded Future Insikt Group. The actor relies on four separate infection methods, including macro-laced documents, PS2EXE-built downloaders, GitHub-hosted PowerShell scripts, and most notably a booby-trapped RAR archive that abuses the WinRAR vulnerability CVE-2025-8088 to install the PickleShell backdoor in the Windows Startup folder. Other custom reverse-shell tools seen in the campaign include FoalShell, Chvost, and Laplas, deployed against targets in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus via phishing emails using diplomatic, trade, and energy-themed lures. Researchers also found exposed staging servers containing a public proof-of-concept for CVE-2025-25257, a SQL injection bug in Fortinet FortiWeb, hinting the group may soon broaden its exploit arsenal.