Silent Lynx Uses WinRAR Flaw to Deploy Reverse Shells in CIS Government Attacks
Summary
Researchers attribute attacks on government organizations across the CIS to Silent Lynx, describing phishing and other delivery methods, including crafted WinRAR archives exploiting CVE-2025-8088 to deploy custom reverse shells.
Key points
- The activity was observed from June 2025 through August 2026 and targeted government organizations across the CIS.
- Researchers describe four infection chains involving macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
- The attacks deploy custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell to provide interactive remote access.
- Spear-phishing lures used diplomatic, trade, energy, and aviation themes; some messages were sent from compromised government accounts.
- The reported lures included documents related to Armenia's Ministry of Foreign Affairs, Turkmenistan airspace, and Russia's Orsk Oil Refinery.
- Staging directories linked to the actor hosted Linux-compatible tools and a public proof-of-concept exploit for FortiWeb flaw CVE-2025-25257; researchers say this may indicate expanded capabilities.
Article Details
- Attack Vectors
- Spear-phishing emails use diplomatic, trade, energy, and aviation-themed decoy documents; some are sent from compromised government email accounts.
- Infection chains use macro-enabled documents, PS2EXE downloaders, and PowerShell hosted on GitHub.
- Crafted WinRAR archives exploit CVE-2025-8088 to deliver malware.
- Three publicly accessible staging directories linked to the threat actor host Linux-compatible tooling and a proof-of-concept exploit for CVE-2025-25257.
MITRE ATT&CK
T1059.001 · PowerShellThe chains use PowerShell hosted on GitHub.T1078 · Valid AccountsPhishing emails were sent from compromised government accounts.T1105 · Ingress Tool TransferPS2EXE downloaders and GitHub-hosted PowerShell are used in the infection chains to deliver components.T1203 · Exploitation for Client ExecutionA crafted WinRAR archive exploits CVE-2025-8088 as part of malware delivery.T1204.002 · Malicious FileThe infection chains use macro-enabled documents and crafted archives as user-opened delivery artifacts.T1566.001 · Spearphishing AttachmentThe actor uses spear-phishing emails containing decoy documents.
CVE
CVE-2025-25257been found to host Linux-compatible tooling and a publicly available proof-of-concept exploit for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb, suggesting a possible expansion of the threat actor'sCVE-2025-8088documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
People
Threat Actors
Malware
ChvostThe attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded FutureFoalShellThe attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded FutureLAPLASThe attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded FuturePickleShellThe attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded Future
Products
FortiWeband a publicly available proof-of-concept exploit for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb, suggesting a possible expansion of the threat actor's operational capabilities.WinRARthat make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088.
Tools
Countries
Armeniaand lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."Azerbaijanlure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."BelarusKazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."KazakhstanAshley Shen said. "Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."Kyrgyzstansaid. "Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."Russiaspan nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."Tajikistanthe reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."Turkmenistancampaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."Uzbekistanobserved victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus."
Industries
Energyactor involve the use of spear-phishing emails containing diplomatic relations, international trade, energy, and aviation-themed decoy documents. No less than eight campaigns have been identified across the regionGovernmentThe threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS).