Quick links
Press Enter to search, Esc to close
Threat group profile
Silent Lynx is a cyber espionage group that targets government bodies in Central Asia and nearby countries. Cisco Talos, which tracks it as UAT-6275, assesses with medium confidence that it has a Kazakhstan nexus.
In short
Silent Lynx is a cyber espionage group that targets government bodies in Central Asia and nearby countries. Cisco Talos, which tracks it as UAT-6275, assesses with medium confidence that it has a Kazakhstan nexus.
Silent Lynx first drew attention in 2025, and our earlier blog post Silent Lynx: Up-and-Coming Espionage Threat From Central Asia covers that first wave. The 2026 research adds the WinRAR route described on our page about CVE-2025-8088 in WinRAR.
Talos assesses a nexus to Kazakhstan, with medium confidence. The group relies on small reverse shells such as PickleShell and LAPLAS, which give the operators a command line on the machine.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Silent Lynx | Name given by Seqrite in its report of 21 January 2025, also used by Talos and Recorded Future[1, 2, 3] |
| UAT-6275 | Cisco Talos tracking name[1] |
| TAG-193 | Recorded Future Insikt Group tracking name[1, 2] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
Cisco Talos 14 Oct 2026
Assesses with medium confidence that UAT-6275 has a Kazakhstan nexus. It cites Russian-language artifacts, test uploads from Kazakhstan shortly after compilation and operator activity that fits UTC+5 working hours.[1]
Recorded Future Insikt Group Oct 2026
Says the findings point to possible links to Kazakhstan, but questions remain about the group's origins. The indicators do not show organisational affiliation or state sponsorship.[2]
Seqrite 21 Jan 2025
Attributed the first campaigns with medium confidence to a Kazakhstan-origin actor that likely shares resources with YoroTrooper.[3]
Seqrite 3 Nov 2025
Attributed the campaigns of its second report to Silent Lynx with high confidence, and rated the victim pattern at medium confidence.[4]
Cisco Talos 14 Oct 2026
Says UAT-6275 and YoroTrooper likely belong to the same broader activity cluster, but tracks them apart because it saw no direct indicator or toolset overlap.[1]
Sources differ on three points. Talos assesses a Kazakhstan nexus with medium confidence, while Recorded Future writes only of possible links and calls origin and sponsorship unresolved. Seqrite in 2025 said the group likely shares resources with YoroTrooper, while Talos in 2026 tracks the two apart. The reports also name different tools: Talos lists PickleShell, Chvost and LAPLAS, and Seqrite lists SILENT LOADER, LAPLAS and SilentSweeper. We found no government or CERT statement that names the group.
Each entry is attributed to the group by the sources cited.
Seqrite says it has tracked the group since November 2024.[4]
Seqrite says it found a malicious Outlook message file on 27 December 2024.[3]
Seqrite names the group after two campaigns in Kyrgyzstan: phishing mail with RAR files, a C++ loader, PowerShell with a Telegram bot, and a Go reverse shell.[3]
Talos sees macro-enabled Word documents that download a second-stage program (its chain A). Its observation window runs from June 2025.[1]
Talos sees downloaders built with PS2EXE that fetch reverse shells and create scheduled tasks (chain B).[1]
A sample uses a decoy that imitates a Turkmen company.[1]
A shortcut file starts PowerShell, which pulls a script from GitHub for remote shell access (chain C). Later samples also drop PickleShell in the Startup folder.[1]
Seqrite reports the group moving toward Tajikistan, with SILENT LOADER, LAPLAS, SilentSweeper and the tunnelling tool Ligolo-ng.[4]
Talos ties a campaign to a Tajik government body, after Kazakhstan and Tajikistan discussed a treaty.[1]
Talos ties a campaign to a Belarusian body before a bilateral meeting.[1]
Talos counts at least eight campaigns through May 2026.[1]
Talos reports activity through August 2026.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 12 Aug 2025 | CISA | Known Exploited Vulnerabilities listingAdds the WinRAR flaw CVE-2025-8088, which the group abused in April 2026. The entry does not name this group, and no government advisory on the group was found.[5] |
Techniques reported for this group, by MITRE ATT&CK tactic.
User Execution: Malicious File T1204.002
Needs the target to open a macro document, a shortcut or an archive.[1]
Exploitation for Client Execution T1203
Used WinRAR flaw CVE-2025-8088 in April 2026 to write a payload when a RAR file is opened.[1]
Command and Scripting Interpreter: PowerShell T1059.001
Runs PowerShell scripts and PowerShell reverse shells, often pulled from GitHub.[1, 3, 4]
PickleShell Reverse shell
Lightweight reverse shell that Talos found in the Startup folder, also in the WinRAR exploit chain.[1]
LAPLAS Implant
Talos calls it a lightweight reverse shell. Seqrite describes a C++ implant with TCP and TLS variants.[1, 4]
Chvost Reverse shell
Lightweight reverse shell named by Talos.[1]
SILENT LOADER Downloader
Seqrite says it downloads and runs a PowerShell script from GitHub.[4]
SilentSweeper .NET implant
Seqrite says it extracts and runs an embedded PowerShell script.[4]
Ligolo-ng Open-source tunnelling tool
Seqrite saw this tunnelling tool in the 2025 campaigns.[4]
RESOCKS Open-source tunnelling tool
Seqrite found it on the group's servers in January 2025.[3, 4]
FortiWeb exploit code Public proof of concept
Talos recovered it from the group's servers for CVE-2025-25257. Recorded Future says use in the wild is not confirmed.[1, 2]
Also linked in our threat library:
Update WinRAR to 7.13 or later on every Windows machine. RARLAB lists Windows RAR, UnRAR and UnRAR.dll as affected too. Talos says patched archive tools reduce exposure.
Counters T1203
Alert on new files in the Startup folder of each user, as Talos advises. A RAR file that writes there is the sign of the 2026 chain.
Counters T1547.001
Alert on new scheduled tasks, mainly those started from Office files, shortcuts or archive tools.
Counters T1053.005
Block macros in files that came from the internet and warn on shortcut files inside archives.
Counters T1204.002
Talos released ClamAV signatures, including Win.Backdoor.PickleShell-10060602-0, and Snort rules. Load them and search for the IOCs in its repository.
Counters T1059.001
Follow reporting on this group and its tools, and match new indicators against your own mail and endpoint logs.
Find lookalike domains and fake public-service login pages that imitate your institution.
Review which of your internet-facing systems and public services are visible to an attacker.
Watch for leaked staff credentials that could let an attacker send mail from a real account.
A cyber espionage group named by Seqrite in January 2025. Cisco Talos tracks it as UAT-6275 and Recorded Future as TAG-193. Talos assesses with medium confidence a Kazakhstan nexus.
Talos names Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus as victim or lure countries.
In April 2026 Talos saw a RAR file that abuses CVE-2025-8088 to place PickleShell in the Windows Startup folder. The malware runs at the next sign-in. See our page on the WinRAR flaw for fixes.
No government has attributed it. Talos assesses a Kazakhstan nexus with medium confidence. Recorded Future says state sponsorship remains unresolved.
Update WinRAR to 7.13 or later, and alert on new files in the Startup folder and on PowerShell that downloads from public sites.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
