How are UAT-6275 and TAG-193 using WinRAR flaws to target CIS governments?
A threat group is exploiting a vulnerability in WinRAR to deploy custom reverse shells on government computers across the Commonwealth of Independent States.
Key points
- Silent Lynx targets government entities in nine CIS countries using four distinct infection chains.
- The campaign exploits CVE-2025-8088 in WinRAR to install reverse shells like FoalShell and Chvost.
- Researchers from Cisco Talos and Recorded Future track the activity under monikers UAT-6275 and TAG-193.
Silent Lynx is conducting a targeted campaign against government organizations across the Commonwealth of Independent States. According to Cisco Talos and Recorded Future Insikt Group, the threat actor deploys custom reverse shells to maintain interactive remote access on compromised hosts. The activity spans a period from June 2025 through August 2026.
Which systems are under attack?
The campaign focuses on government bodies in Central Asia and the wider CIS region. Security researcher Ashley Shen noted that victims span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. The threat actor was first documented by Seqrite Labs in early 2025, with historical attacks targeting embassies, lawyers, and think tanks in Kyrgyzstan and Turkmenistan.
How does the malware enter networks?
Silent Lynx utilizes four different infection chains to breach targets. These methods include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and crafted WinRAR archives. The latter specifically exploits CVE-2025-8088. Initial access is typically achieved through spear-phishing emails containing decoy documents themed around diplomatic relations, international trade, energy, and aviation.
What tools do the attackers use?
Once inside a network, the group installs custom reverse shells to facilitate remote control. The observed payloads include FoalShell, Chvost, Laplas, and PickleShell. Cisco Talos and Recorded Future track this specific campaign as UAT-6275 and TAG-193. Silent Lynx is assessed as a Kazakhstan-nexus actor active since at least 2020, with suspected overlaps to other clusters like YoroTrooper and ShadowSilk.
Is there a fix available yet?
The source material does not confirm the availability of a patch for CVE-2025-8088 or a specific remediation for the deployed reverse shells. Until vendors provide updates, organizations should assume the vulnerability remains exploitable. No direct indicator or toolset overlap has been observed between UAT-6275 and YoroTrooper, though they are suspected to be part of the same broader activity cluster.
What analysts watch for
Teams usually monitor for unusual PowerShell execution from unexpected directories, especially if sourced from public repositories like GitHub. Analysts should examine macro-enabled documents that attempt to download additional payloads via PS2EXE or similar wrappers. Check whether WinRAR processes are spawning command shells or network connections to external IPs.
Look for the creation of new executable files in temporary directories that match the naming conventions of known reverse shells. Investigate any outbound traffic that bypasses standard proxy rules, as reverse shells often attempt to maintain persistent connections to command-and-control servers. Review email logs for attachments with themes related to trade or diplomacy, which are common lures for this type of targeted campaign.
What to do and how to stay safe: Silent Lynx
- Verify that all instances of WinRAR are updated to the latest version that addresses CVE-2025-8088, once the vendor provides an update.
- Restrict the execution of PowerShell scripts from external sources and monitor for PS2EXE downloader activity.
- Train users to identify spear-phishing emails containing decoy documents related to trade, energy, or diplomacy.
- Monitor network logs for outbound connections that may indicate the presence of reverse shells like FoalShell or Chvost.
Step-by-step guide: Build an Incident Response Plan That Actually Works
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What countries are targeted by Silent Lynx?
The campaign targets government organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.
Which vulnerability does Silent Lynx exploit in WinRAR?
The threat actor exploits CVE-2025-8088 in crafted WinRAR archives to deploy malicious payloads.
What are the names of the reverse shells used?
The campaign deploys custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell to facilitate remote access.
