Silent Lynx (UAT-6275 / TAG-193): Cisco Talos and Recorded Future tie Kazakhstan-nexus espionage against CIS governments to four infection chains, including WinRAR CVE-2025-8088 archives, and find FortiWeb exploit tooling on the group's staging servers
Cisco Talos published joint research with Recorded Future's Insikt Group on 14 October 2026 on UAT-6275 (Recorded Future: TAG-193), activity that overlaps with the group publicly known as Silent Lynx. Talos assesses with medium confidence that the group has a Kazakhstan nexus, based on infrastructure access, language artefacts, sample submissions, working-hours analysis and targeting. Between June 2025 and August 2026 Talos saw four infection chains against government organisations across the Commonwealth of Independent States: macro-enabled Word documents (June 2025); PS2EXE-built downloaders that fetch reverse shells and add scheduled tasks (July 2025); LNK shortcuts in RAR archives that run a GitHub-hosted PowerShell script (October 2025); and, from April 2026, RAR archives exploiting the WinRAR path-traversal flaw CVE-2025-8088 to drop the PickleShell reverse shell into the Windows Startup folder. That is the first vulnerability exploit Talos has seen in the group's malware delivery. Payloads are lightweight custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Lures included a diplomatic letter to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form and a proposal involving Russia's Orsk Oil Refinery, with additional interest in water resources, the environment and energy. Phishing emails were sent from compromised government accounts. Three publicly exposed staging directories and an unreported GitHub repository revealed payload builds and C2 changes. They also held Linux tooling and a public exploit for the FortiWeb SQL injection CVE-2025-25257, suggesting plans to target Linux hosts and internet-facing appliances. Talos believes UAT-6275 and YoroTrooper are likely part of the same broader cluster but tracks them separately. Primary: Cisco Talos; also Recorded Future Insikt Group; wire: The Hacker News (15 Oct).
- Product
- Windows endpoints at government organisations in Central Asia and the CIS; WinRAR for Windows (CVE-2025-8088)
- Versions
- WinRAR for Windows before 7.13 (CVE-2025-8088 fixed in WinRAR 7.13, 30 Jul 2025; Linux/Unix and Android builds not affected). Campaign activity June 2025 – August 2026.
- CVSS
- CVE-2025-8088: 8.8 (CVSS 3.1, NVD); 8.4 (CVSS 4.0, ESET)
- Exploited in Australia?
- unknown
- Patch to
- Update WinRAR, UnRAR and other RARLAB components on Windows to 7.13 or later, and find old copies bundled with other software. Quarantine RAR attachments from outside senders where possible. Alert on new files in user Startup folders and on PowerShell launched from LNK files or Office documents. Patch FortiWeb against CVE-2025-25257, since the group staged a public exploit for it.
Primary: Cisco Talos — Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (14 Oct 2026) · Vendor: Recorded Future Insikt Group — TAG-193 regional espionage operations · CVE: CVE-2025-8088, CVE-2025-25257 · The Hacker News — Silent Lynx exploits WinRAR flaw to deploy reverse shell in CIS government attacks (15 Oct 2026)