Overview
Silent Lynx first drew attention in 2025, and our earlier blog post Silent Lynx: Up-and-Coming Espionage Threat From Central Asia covers that first wave. The 2026 research adds the WinRAR route described on our page about CVE-2025-8088 in WinRAR.
Talos assesses a nexus to Kazakhstan, with medium confidence. The group relies on small reverse shells such as PickleShell and LAPLAS, which give the operators a command line on the machine.
Names
Public reports use several names for this activity.
Who says so
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
-
Cisco Talos 14 Oct 2026
Assesses with medium confidence that UAT-6275 has a Kazakhstan nexus. It cites Russian-language artifacts, test uploads from Kazakhstan shortly after compilation and operator activity that fits UTC+5 working hours.[1]
-
Recorded Future Insikt Group Oct 2026
Says the findings point to possible links to Kazakhstan, but questions remain about the group's origins. The indicators do not show organisational affiliation or state sponsorship.[2]
-
Seqrite 21 Jan 2025
Attributed the first campaigns with medium confidence to a Kazakhstan-origin actor that likely shares resources with YoroTrooper.[3]
-
Seqrite 3 Nov 2025
Attributed the campaigns of its second report to Silent Lynx with high confidence, and rated the victim pattern at medium confidence.[4]
-
Cisco Talos 14 Oct 2026
Says UAT-6275 and YoroTrooper likely belong to the same broader activity cluster, but tracks them apart because it saw no direct indicator or toolset overlap.[1]
Where sources differ
Sources differ on three points. Talos assesses a Kazakhstan nexus with medium confidence, while Recorded Future writes only of possible links and calls origin and sponsorship unresolved. Seqrite in 2025 said the group likely shares resources with YoroTrooper, while Talos in 2026 tracks the two apart. The reports also name different tools: Talos lists PickleShell, Chvost and LAPLAS, and Seqrite lists SILENT LOADER, LAPLAS and SilentSweeper.
We found no government or CERT statement that names the group.
Who they target
Sectors
- Ministries and agenciesTalos lists bodies covering diplomacy, economic development, agriculture and environmental management.[1]
- Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, UzbekistanTalos names these as victim or lure countries. Seqrite's first campaigns hit government finance bodies in Kyrgyzstan.[1, 3]
- Armenia, Azerbaijan, Russia, BelarusTalos names these as victim or lure countries. A credential-harvesting site imitated an Azerbaijani public service agency.[1]
- Environmental and forestry bodiesTalos lists an Armenian environmental government body and a forestry initiative in Uzbekistan. Recorded Future adds water resources.[1, 2]
- Oil and gas themesTalos found a decoy about energy cooperation between Turkmenistan and Russia. Recorded Future saw a business-proposal lure about a Russian oil refinery.[1, 2]
- Industry targetsSeqrite lists mining, transport and communications among the targets of its second report.[4]
- Policy and diplomatic staffSeqrite lists embassies, lawyers, government banks and government think tanks in its first report.[3]
Operations timeline
Each entry is attributed to the group by the sources cited.
- Nov 2024
Seqrite starts tracking
Seqrite says it has tracked the group since November 2024.[4]
- 27 Dec 2024
First sample found
Seqrite says it found a malicious Outlook message file on 27 December 2024.[3]
- 21 Jan 2025
Silent Lynx named
Seqrite names the group after two campaigns in Kyrgyzstan: phishing mail with RAR files, a C++ loader, PowerShell with a Telegram bot, and a Go reverse shell.[3]
- Jun 2025
Talos window opens
Talos sees macro-enabled Word documents that download a second-stage program (its chain A). Its observation window runs from June 2025.[1]
- Jul 2025
PS2EXE downloaders
Talos sees downloaders built with PS2EXE that fetch reverse shells and create scheduled tasks (chain B).[1]
- Aug 2025
Turkmen decoy
A sample uses a decoy that imitates a Turkmen company.[1]
- Oct 2025
Shortcut and GitHub script
A shortcut file starts PowerShell, which pulls a script from GitHub for remote shell access (chain C). Later samples also drop PickleShell in the Startup folder.[1]
- 3 Nov 2025
Shift to Tajikistan
Seqrite reports the group moving toward Tajikistan, with SILENT LOADER, LAPLAS, SilentSweeper and the tunnelling tool Ligolo-ng.[4]
- Mar 2026
Tajik government body
Talos ties a campaign to a Tajik government body, after Kazakhstan and Tajikistan discussed a treaty.[1]
- Apr 2026
- Apr 2026
Belarus lure
Talos ties a campaign to a Belarusian body before a bilateral meeting.[1]
- May 2026
Eight campaigns
Talos counts at least eight campaigns through May 2026.[1]
- Aug 2026
Window closes
Talos reports activity through August 2026.[1]
- 14 Oct 2026
Government actions
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 12 Aug 2025 | CISA | Known Exploited Vulnerabilities listingAdds the WinRAR flaw CVE-2025-8088, which the group abused in April 2026. The entry does not name this group, and no government advisory on the group was found.[5] |
How they get in
Techniques reported for this group, by MITRE ATT&CK tactic.
Resource Development
Initial Access
Execution
-
User Execution: Malicious File T1204.002
Needs the target to open a macro document, a shortcut or an archive.[1]
-
Exploitation for Client Execution T1203
Used WinRAR flaw CVE-2025-8088 in April 2026 to write a payload when a RAR file is opened.[1]
-
Command and Scripting Interpreter: PowerShell T1059.001
Runs PowerShell scripts and PowerShell reverse shells, often pulled from GitHub.[1, 3, 4]
Persistence
Tools and malware
-
PickleShell Reverse shell
Lightweight reverse shell that Talos found in the Startup folder, also in the WinRAR exploit chain.[1]
-
LAPLAS Implant
Talos calls it a lightweight reverse shell. Seqrite describes a C++ implant with TCP and TLS variants.[1, 4]
-
Chvost Reverse shell
Lightweight reverse shell named by Talos.[1]
-
SILENT LOADER Downloader
Seqrite says it downloads and runs a PowerShell script from GitHub.[4]
-
SilentSweeper .NET implant
Seqrite says it extracts and runs an embedded PowerShell script.[4]
-
Ligolo-ng Open-source tunnelling tool
Seqrite saw this tunnelling tool in the 2025 campaigns.[4]
-
RESOCKS Open-source tunnelling tool
Seqrite found it on the group's servers in January 2025.[3, 4]
-
FortiWeb exploit code Public proof of concept
Talos recovered it from the group's servers for CVE-2025-25257. Recorded Future says use in the wild is not confirmed.[1, 2]
Also linked in our threat library:
Vulnerabilities exploited
Detection and defense
-
Patch archive tools
Update WinRAR to 7.13 or later on every Windows machine. RARLAB lists Windows RAR, UnRAR and UnRAR.dll as affected too. Talos says patched archive tools reduce exposure.
Counters T1203
-
Watch the Startup folder
Alert on new files in the Startup folder of each user, as Talos advises. A RAR file that writes there is the sign of the 2026 chain.
Counters T1547.001
-
Watch scheduled tasks
Alert on new scheduled tasks, mainly those started from Office files, shortcuts or archive tools.
Counters T1053.005
-
Restrict risky files
Block macros in files that came from the internet and warn on shortcut files inside archives.
Counters T1204.002
-
Use published detections
Talos released ClamAV signatures, including Win.Backdoor.PickleShell-10060602-0, and Snort rules. Load them and search for the IOCs in its repository.
Counters T1059.001
What Brandefense can do
- Cyber Threat Intelligence
Follow reporting on this group and its tools, and match new indicators against your own mail and endpoint logs.
- Phishing Monitoring & Domain Abuse
Find lookalike domains and fake public-service login pages that imitate your institution.
- External Attack Surface Management
Review which of your internet-facing systems and public services are visible to an attacker.
- Dark Web Monitoring
Watch for leaked staff credentials that could let an attacker send mail from a real account.
Frequently Asked Questions
Who is Silent Lynx?
A cyber espionage group named by Seqrite in January 2025. Cisco Talos tracks it as UAT-6275 and Recorded Future as TAG-193. Talos assesses with medium confidence a Kazakhstan nexus.
Which countries does Silent Lynx target?
Talos names Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus as victim or lure countries.
How does Silent Lynx use WinRAR?
In April 2026 Talos saw a RAR file that abuses CVE-2025-8088 to place PickleShell in the Windows Startup folder. The malware runs at the next sign-in. See our page on the WinRAR flaw for fixes.
Is Silent Lynx linked to a government?
No government has attributed it. Talos assesses a Kazakhstan nexus with medium confidence. Recorded Future says state sponsorship remains unresolved.
What should defenders do first?
Update WinRAR to 7.13 or later, and alert on new files in the Startup folder and on PowerShell that downloads from public sites.
Sources
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizationsCisco Talos · Supports: Names, campaigns, chains A to D, tools, targets, attribution, detections
- TAG-193's Regional Espionage OperationsRecorded Future Insikt Group · Supports: Targets, lures, Kazakhstan wording, FortiWeb exploit note
- Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighbouring NationsSeqrite Labs · Supports: The name Silent Lynx, January 2025 campaigns, tools, YoroTrooper overlap
- Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to DushanbeSeqrite Labs · Supports: November 2025 campaigns, SILENT LOADER, LAPLAS, SilentSweeper, tracking since November 2024
- Known Exploited Vulnerabilities CatalogCISA · Supports: CVE-2025-8088 added on 12 August 2025
- CVE-2025-8088NIST NVD · Supports: Flaw description and credit
- WinRAR release notes, version 7.13RARLAB · Supports: Fix in 7.13, affected components
- Break the silence: tracking Silent Lynx through exposed infrastructureVirus Bulletin · Supports: Joint paper on the exposed infrastructure
