Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
thehackernews.com Oct 15, 2026

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

AI-summarised brief · reviewed before publication

Silent Lynx, a Kazakhstan‑based threat actor, has conducted a sustained campaign against CIS governments from June 2025 to August 2026. The attacks use four distinct infection chains—macro‑enabled documents, PS2EXE downloaders, GitHub‑hosted PowerShell, and WinRAR archives exploiting CVE‑2025‑8088—to deploy custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Cisco Talos and Recorded Future track the effort as UAT‑6275/TAG‑193, targeting nine CIS countries, including Russia, Belarus, and Central Asian states. The campaign’s breadth and evolving delivery methods underscore its persistent threat to regional governance and critical infrastructure.

💡 Why It Matters

  • · The use of a newly weaponized CVE in a high‑profile supply‑chain tool signals a shift toward more sophisticated, low‑visibility intrusion tactics.
  • · This escalation heightens the risk to government and energy sectors that rely on legacy software, demanding immediate patching and advanced monitoring.