Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future, has been attributed to a campaign targeting government organizations across the Commonwealth of Independent States (CIS). Observed from June 2025 through August 2026, the activity used four distinct infection chains, including a WinRAR archive that exploits CVE-2025-8088. The attacks deliver custom reverse shells—FoalShell, Chvost, Laplas, and PickleShell—that give the operators interactive remote access to compromised machines.
The threat actor's focus is concentrated in Central Asia and the wider CIS, with victims spanning nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Spear-phishing emails are sent from compromised government accounts and use official-looking documents themed around diplomatic relations, international trade, energy, and aviation to lend the social engineering a veneer of credibility.
The April 2026 infection chain marks the first time Silent Lynx has weaponized a security flaw in its delivery methods. Researchers also found three publicly accessible staging directories hosting Linux-compatible tooling and a proof-of-concept for CVE-2025-25257, a Fortinet FortiWeb SQL injection vulnerability, suggesting a possible expansion of capabilities. Talos assesses that the group's sustained activity and interest in environmental agencies, economic ministries, and energy infrastructure reflect the intelligence value of regional diplomacy and resource management.