LAPLAS is a Windows implant used by the group Silent Lynx. Cisco Talos calls it a lightweight reverse shell. Seqrite describes a C++ implant with TCP and TLS versions that talks to the operators' servers.
What it does
Two security firms describe LAPLAS in different words. Cisco Talos groups it with PickleShell and Chvost as a lightweight reverse shell. Seqrite, in a report of 3 November 2025, lists LAPLAS as a C++ implant with TCP and TLS variants, next to SILENT LOADER and SilentSweeper.
Seqrite places it in the toolkit of the Silent Lynx group; Cisco Talos lists it with the PickleShell reverse shell in the toolkit of UAT-6275, a cluster it says overlaps with Silent Lynx. Seqrite adds that the TCP build takes a server and port on its command line, falls back to a hard-coded server on port 443 and runs commands through cmd.exe. It found the TLS build by pivoting, not in a campaign.
Names
Public sources use several names for this malware.
How it spreads
Seqrite does not describe how LAPLAS itself reaches a PC. It places the TCP build in a Russia and Azerbaijan campaign that began with a fake RAR file holding a shortcut, which started PowerShell and fetched a script from GitHub. In most campaigns the archive and the file inside it share a similar name. In a separate campaign a PowerShell script created a scheduled task named WindowsUpdate that ran every six minutes.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Lure mail
A spear-phishing mail carries an archive with a themed decoy name.[2]
Shortcut starts
In the Russia and Azerbaijan campaign a shortcut inside a fake RAR file starts PowerShell, which pulls a script from GitHub.[2]
Implant present
Seqrite found the C++ TCP build of LAPLAS in that campaign without saying how it was dropped.[2]
Operators connect
The TCP build connects to a server and port from its command line or a hard-coded default and runs commands through cmd.exe.[2]
Timeline
- Jan 2025
First Silent Lynx report
Seqrite names the group; the tools in that report differ from LAPLAS.[3]
- 3 Nov 2025
LAPLAS in Seqrite report
Seqrite lists LAPLAS as a C++ implant with TCP and TLS variants.[2]
- 14 Oct 2026
Talos report
Cisco Talos lists LAPLAS as a lightweight reverse shell and publishes two ClamAV signatures.[1]
Who uses it
Detection and defense
Frequently Asked Questions
What is LAPLAS?
A Windows implant used by Silent Lynx. Talos calls it a lightweight reverse shell, and Seqrite describes a C++ implant with TCP and TLS variants.
Who uses LAPLAS?
Seqrite links it to Silent Lynx, and Cisco Talos links it to UAT-6275, which Talos says overlaps with Silent Lynx.
How does it get onto a PC?
Seqrite does not say how LAPLAS is dropped. It found the TCP build in a campaign that began with a fake RAR file holding a shortcut that ran PowerShell from GitHub.
How can I detect it?
Use the Talos ClamAV signatures for LAPLAS, and watch for scheduled tasks and PowerShell downloads from public sites.
Sources
- Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizationsCisco Talos · Supports: LAPLAS as a lightweight reverse shell, signatures, advice
- Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to DushanbeSeqrite Labs · Supports: C++ implant with TCP and TLS variants, delivery, scheduled task
- Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighbouring NationsSeqrite Labs · Supports: First Silent Lynx report of January 2025
- TAG-193's Regional Espionage OperationsRecorded Future Insikt Group · Supports: LAPLAS named in the group's toolkit
- Command and Scripting Interpreter: PowerShell (T1059.001)MITRE ATT&CK · Supports: Technique name
- Scheduled Task/Job: Scheduled Task (T1053.005)MITRE ATT&CK · Supports: Technique name
