Technique
Scheduled Task/Job
Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system.
Read more
Malware profile
LAPLAS implant
LAPLAS is a Windows implant used by the group Silent Lynx.
In short
LAPLAS is a Windows implant used by the group Silent Lynx. Cisco Talos calls it a lightweight reverse shell. Seqrite describes a C++ implant with TCP and TLS versions that talks to the operators' servers.
- Names1names in public reportsLAPLAS
- Infection Steps4in the delivery chainLure mail · Shortcut starts
- Linked Groups1groups that use itSilent Lynx
In one minute
- What it is
- A small Windows implant that gives remote command access.
- What it does
- Talos calls it a lightweight reverse shell for running commands on compromised systems. Seqrite saw a C++ build with TCP and TLS variants.
- Who uses it
- Attributed by Cisco Talos and Seqrite to the group Silent Lynx, tracked by Talos as UAT-6275 and by Recorded Future as TAG-193.
- How it gets in
- Seqrite found the TCP build in the group's Russia and Azerbaijan campaign, which began with a fake RAR file holding a shortcut that ran PowerShell from GitHub. It does not say how LAPLAS itself was dropped.
- What to do first
- Alert on PowerShell that downloads from GitHub, and on new scheduled tasks.
What it does
Two security firms describe LAPLAS in different words. Cisco Talos groups it with PickleShell and Chvost as a lightweight reverse shell. Seqrite, in a report of 3 November 2025, lists LAPLAS as a C++ implant with TCP and TLS variants, next to SILENT LOADER and SilentSweeper.
It belongs to the toolkit of the Silent Lynx group, which also uses the PickleShell reverse shell. Seqrite adds that the TCP build takes a server and port on its command line, falls back to a hard-coded server on port 443 and runs commands through cmd.exe. It found the TLS build by pivoting, not in a campaign.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| LAPLAS | Name used by Cisco Talos and Seqrite; Talos ClamAV signatures Win.Malware.LAPLAS-10060605-0 and Win.Malware.LAPLAS-10060606-0[1, 2] |
How it spreads
Seqrite does not describe how LAPLAS itself reaches a PC. It places the TCP build in a Russia and Azerbaijan campaign that began with a fake RAR file holding a shortcut, which started PowerShell and fetched a script from GitHub. In most campaigns the archive and the file inside it share a similar name. In a separate campaign a PowerShell script created a scheduled task named WindowsUpdate that ran every six minutes.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Lure mail
A spear-phishing mail carries an archive with a themed decoy name.[2]
Shortcut starts
In the Russia and Azerbaijan campaign a shortcut inside a fake RAR file starts PowerShell, which pulls a script from GitHub.[2]
Implant present
Seqrite found the C++ TCP build of LAPLAS in that campaign without saying how it was dropped.[2]
Operators connect
The TCP build connects to a server and port from its command line or a hard-coded default and runs commands through cmd.exe.[2]
Timeline
- Jan 2025
First Silent Lynx report
Seqrite names the group; the tools in that report differ from LAPLAS.[3]
- 3 Nov 2025
LAPLAS in Seqrite report
Seqrite lists LAPLAS as a C++ implant with TCP and TLS variants.[2]
- 14 Oct 2026
Talos report
Cisco Talos lists LAPLAS as a lightweight reverse shell and publishes two ClamAV signatures.[1]
Who uses it
Detection and defense
Questions
What is LAPLAS?
A Windows implant used by Silent Lynx. Talos calls it a lightweight reverse shell, and Seqrite describes a C++ implant with TCP and TLS variants.
Who uses LAPLAS?
Cisco Talos and Seqrite both link it to Silent Lynx, which Talos tracks as UAT-6275.
How does it get onto a PC?
Seqrite does not say how LAPLAS is dropped. It found the TCP build in a campaign that began with a fake RAR file holding a shortcut that ran PowerShell from GitHub.
How can I detect it?
Use the Talos ClamAV signatures for LAPLAS, and watch for scheduled tasks and PowerShell downloads from public sites.
In our research
- Silent Lynx Threat group
Sources
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations Cisco TalosSupports: LAPLAS as a lightweight reverse shell, signatures, advice
- Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to Dushanbe Seqrite LabsSupports: C++ implant with TCP and TLS variants, delivery, scheduled task
- Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighbouring Nations Seqrite LabsSupports: First Silent Lynx report of January 2025
- TAG-193's Regional Espionage Operations Recorded Future Insikt GroupSupports: LAPLAS named in the group's toolkit
- Command and Scripting Interpreter: PowerShell (T1059.001) MITRE ATT&CKSupports: Technique name
- Scheduled Task/Job: Scheduled Task (T1053.005) MITRE ATT&CKSupports: Technique name
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.