Silent Lynx targets CIS governments with WinRAR exploit

On 15 October Cisco Talos and Recorded Future’s Insikt Group published a joint report on Silent Lynx, a cyber-espionage group that the researchers link, with medium confidence, to Kazakhstan. The group targets ministries, diplomatic missions and public bodies in the Commonwealth of Independent States (CIS) and, in April 2026, used an exploit for the first time: the WinRAR vulnerability CVE-2025-8088, to drop malware into the Windows Startup folder. The story was covered by The Record, Security Affairs and The Hacker News.

What happened

Talos tracks the group as UAT-6275, Insikt Group as TAG-193. According to Security Affairs, the activity overlaps with what was previously described as YoroTrooper, ShadowSilk and Hydra Saiga. The sources differ on the timeline: The Record speaks of at least eight campaigns since January 2025, while Security Affairs, quoting the report, writes that the group has been active since at least 2024.

According to The Record, the actual or intended targets are government bodies in nine countries, including Russia, Belarus, Armenia, Uzbekistan and Tajikistan, with a particular focus on foreign affairs, economic development, agriculture, environment, energy and water resources. The two sources cite several cases:

• a Tajik government entity, in March 2026, shortly after the Kazakh parliament ratified an alliance treaty with Tajikistan;
• a Belarusian government entity, in April, about a week before a bilateral meeting in Astana;
• an Armenian environmental agency and Uzbekistan’s Smart Forestry initiative (The Record);
• the Orsk refinery in Russia and the government of Nizhny Novgorod (Security Affairs).

The researchers point out that the timing of diplomatic events does not prove what information the group was after, nor whether it obtained it.

Technical details

• Initial access: spear-phishing emails with attachments imitating diplomatic correspondence, aviation forms and business proposals, often sent from already compromised government mailboxes (in Tajikistan and Kyrgyzstan, according to Security Affairs).
• CVE-2025-8088 (WinRAR): a path traversal vulnerability that, when a crafted archive is opened, writes files outside the extraction folder. In April 2026, in an operation likely aimed at Armenia’s Ministry of Foreign Affairs, the group used it to place malware in the Windows Startup folder, which runs at the user’s next sign-in. No macros are needed. It is the first exploit observed in the group’s arsenal.
• Tools: PowerShell reverse shells, custom shells written in C++, C# and Go (the report mentions Chvost and PickleShell), common tunnelling tools.
• Infrastructure: scripts and files hosted on GitHub, Telegram and hijacked legitimate servers, to blend in with normal traffic.
• Sample lure: a sample compiled in August 2025 used a Russian-language PDF about an alleged cooperation proposal between the Turkmen company Turkmennebit and the Orsk refinery, created one hour after the payload.
• New interests: the command-and-control server held a public proof of concept for a FortiWeb authentication bypass (the sources do not give the CVE), and there are signs of interest in Linux systems.

MITRE ATT&CK (our mapping, based on the activity described): T1566.001 (Spearphishing Attachment), T1586.002 (Compromise Accounts: Email Accounts), T1203 (Exploitation for Client Execution), T1547.001 (Registry Run Keys / Startup Folder), T1059.001 (PowerShell), T1102 (Web Service), T1572 (Protocol Tunneling).

How they got to Kazakhstan

According to Security Affairs, the group gave itself away by leaving open directories on public servers with tools, payloads and a shell command history: whoami typed with the Russian layout active came out as “црщфьш”. Other clues reported:

• 95% of the 77 GitHub commits fall within Astana working hours, compared with 51% using Moscow time;
• administration connections came from ProtonVPN addresses geolocated in Kazakhstan, only on weekdays between 7 am and noon;
• two samples were uploaded to VirusTotal from Kazakhstan 86 seconds and about four minutes after compilation, a typical detection test;
• Russian-language material in the malware (The Record).

Impact for European and Italian companies

The sources do not mention victims in the European Union. The risk mainly concerns organisations with ties to public bodies and energy companies in Central Asia: the emails come from genuine but compromised official addresses, so they pass sender checks. The technical vector, however, is general: WinRAR is installed on a great many corporate workstations, often without automatic updates. For NIS2 entities in the energy and public administration sectors, an unpatched vulnerable version is a gap in vulnerability management.

What to do now

1. Update WinRAR on every workstation to the latest version (the fix for CVE-2025-8088 is available from 7.13) and take an inventory of installed versions, including portable copies.
2. Monitor the Startup folder: flag every new file in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup and in the all-users folder, especially if written by WinRAR or an extraction process.
3. Check PowerShell: enable script block logging and look for outbound connections started by powershell.exe to little-known addresses.
4. Filter compressed attachments from external senders, including official ones, and detonate them in a sandbox.
5. Watch traffic to GitHub and Telegram from machines that should not use them, and unauthorised tunnelling tools.
6. Import the indicators from the joint Talos and Insikt Group report (hashes, infrastructure) into your detection systems.

How ARXDOME helps

ARX Shield shows the open vulnerabilities on every machine, including programs such as WinRAR, integrates the antivirus/EDR console and lets you isolate a suspicious workstation. ARX Sentry brings logs and events from computers, servers and firewalls into the SOC pages, where unusual processes and connections stand out. With ARX Trace you can search multiple machines for files in the Startup folder and for the published indicators, and ARX Horizon enriches events with threat intelligence sources.

Last updated: 15 October 2026