"UAT-6275's targeting is concentrated in Central Asia, and the wider CIS region," security researcher Ashley Shen said.
Scope, timeline, and geographic focus
Security firms tracking the activity attribute a fresh campaign of intrusions to the threat actor known as Silent Lynx, tracked under the labels UAT-6275 and TAG-193. The activity was observed from June 2025 through August 2026 and includes no fewer than eight campaigns between January 2025 and May 2026. Recorded Future Insikt Group reports lure themes and observed victims across nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Seqrite Labs first publicly documented Silent Lynx in early 2025, noting targeting that included embassies, lawyers, government-backed banks, and think tanks in Kyrgyzstan and Turkmenistan. Cisco Talos highlighted the group's interest in environmental agencies, economic ministries, and energy infrastructure.
Four distinct infection chains, and the WinRAR flaw CVE-2025-8088
Analysts have mapped four separate infection pathways used by the group. In June 2025 the actor used macro-enabled Word documents to download and run a second-stage binary. In July 2025 attackers distributed downloaders built with PS2EXE—packaged PowerShell scripts compiled as Windows executables—to fetch reverse-shell payloads and create scheduled tasks for persistence. In October 2025 the actor placed a malicious shortcut (LNK) inside a RAR archive to launch PowerShell that retrieved a GitHub-hosted script providing remote shell access; later iterations of that chain also downloaded PickleShell and staged it in the Windows Startup folder so it would launch at user logon. In April 2026 the group used a RAR archive that exploits a WinRAR flaw, tracked as CVE-2025-8088, to drop PickleShell into the Startup folder—marking the first time UAT-6275 was observed weaponizing a security flaw as part of its delivery methods.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageInteractive implants: FoalShell, Chvost, Laplas, and PickleShell
Cisco Talos and Recorded Future describe the deployed tools as custom reverse shells—named FoalShell, Chvost, Laplas, and PickleShell—that provide interactive remote access to compromised hosts. The PS2EXE-based chains are reported to create scheduled tasks for persistence; the RAR/LNK and CVE-2025-8088 chains stage PickleShell in the Windows Startup folder to achieve automatic execution on user logon. Attack lures are diplomatic, trade, energy, and aviation themed and are sent from compromised government accounts, according to Recorded Future; identified decoys include a diplomatic letter to Armenia’s Ministry of Foreign Affairs, a Turkmenistan airspace application form, and a business proposal concerning Russia’s Orsk Oil Refinery.
Overlap with other tracked clusters: YoroTrooper, Hydra Saiga, and operational footprint
Analysts assess Silent Lynx as a Kazakhstan‑nexus actor active since at least 2020 and note overlaps with clusters codenamed YoroTrooper (also tracked as Comrade Saiga, ShadowSilk, and SturgeonPhisher), ShadowSilk, Cavalry Werewolf, and Tomiris. While UAT-6275 and YoroTrooper are suspected to belong to the same broader activity cluster, the reporting states no direct indicator or toolset overlap has been observed between them. VMRay separately disclosed that a cluster it tracks as Hydra Saiga—also associated with Comrade Saiga—compromised at least 34 organizations across eight countries since December 2024 and conducted reconnaissance of over 200 additional targets. That reporting ties the "hydra" alias to an operational focus on breaching infrastructure linked to water resources in Central Asia and notes the use of custom implants written in Rust, Go, and Python alongside Living-off-the-Land techniques.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: expect to hunt for artifacts tied to RAR/LNK exploitation and Startup-folder persistence, inspect scheduled tasks created by PS2EXE downloaders, and monitor for GitHub-hosted PowerShell scripts and externally hosted payload staging.
- Policymakers and regulators: the pattern of targeting—environmental agencies, economic ministries, and energy infrastructure—underscores cross-border intelligence value; the April 2026 use of CVE-2025-8088 and the public proof-of-concept for CVE-2025-25257 in attacker-accessible staging directories highlight the need to coordinate vulnerability disclosure and patching efforts regionally.
- Affected enterprises and procurement leaders: the campaign demonstrates social‑engineering via compromised government accounts and legitimate-looking decoys; controls around document macros, executable‑packaging tools like PS2EXE, and validated sourcing for GitHub-hosted scripts are concrete mitigations to prioritize.
Silent Lynx's sustained activity, its movement from social‑engineering and living‑off‑the‑land techniques toward weaponized exploitation, and the presence of publicly accessible staging directories and proof‑of‑concept exploits all point to a campaign that is evolving in both scope and technical reach. Cisco Talos warned the group will likely continue pursuing access to government organizations across Central Asia and the CIS; the central question the record leaves is whether regional agencies and their partners will close the specific delivery and vulnerability gaps—such as those exploited by CVE-2025-8088 and the publicly staged CVE-2025-25257 proof-of-concept—before the actor expands these methods further.
