Silent Lynx (UAT-6275) uses WinRAR CVE-2025-8088 and reverse shells against CIS government targets
Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Victims and lures span nine countries, with the focus on Central Asia. The April 2026 chain is the first time the group has weaponized a vulnerability, CVE-2025-8088 in WinRAR. The actor is assessed as Kazakhstan-nexus and active since at least 2020, with overlaps with YoroTrooper, Cavalry Werewolf and Tomiris.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2025-25257. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
The file targets the unauthenticated SQL injection in FortiWeb's Fabric Connector (CVE-2025-25257), reached over HTTPS through a fabric status API that mishandles the bearer token in the Authorization header. The attacker needs only network access to the management interface and a vulnerable 7.x release, with no login or user interaction. The script sends one request with a basic always-true SQL string and prints the reply, so it is a crude probe, not a working exploit. Despite the title, it contains no remote code execution chain, and its success is not verified.
Detalhes técnicos
- Spear-phishing emails are sent from compromised government accounts, with diplomatic, trade, energy and aviation lures. Examples include a letter to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form and a business proposal about Russia's Orsk Oil Refinery.
- Four infection chains:
- June 2025: macro-enabled Word documents download and run a second-stage binary.
- July 2025: PS2EXE downloaders fetch reverse-shell payloads and create scheduled tasks for persistence.
- October 2025: an LNK inside a RAR archive launches PowerShell that retrieves a GitHub-hosted script giving remote shell access. Later iterations stage PickleShell in the Windows Startup folder.
- April 2026: a RAR archive exploiting CVE-2025-8088 drops PickleShell in the Startup folder.
- Three public staging directories tied to the actor hosted Linux-compatible tooling and a public proof-of-concept for CVE-2025-25257, a SQL injection flaw in Fortinet FortiWeb. This suggests a possible expansion of capabilities.
- Talos suspects UAT-6275 and YoroTrooper belong to the same broader cluster, but no direct indicator or toolset overlap has been observed.
- VMRay separately reported that Hydra Saiga (the same actor as Comrade Saiga) compromised at least 34 organizations in 8 countries since December 2024, focusing on water-resource infrastructure.
Remediação
The article gives no explicit remediation. The exploited flaw is CVE-2025-8088 in WinRAR, so defenders should ensure WinRAR is patched. They should also watch for Startup-folder persistence, PS2EXE-built binaries, and PowerShell fetching scripts from GitHub.
Linha do tempo
-
Silent Lynx (UAT-6275) uses WinRAR CVE-2025-8088 and reverse shells against CIS government targets
ler a análise desta fonte ocultar
Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvost, Laplas, PickleShell). Victims and lures span nine countries, with the focus on Central Asia. The April 2026 chain is the first time the group has weaponized a vulnerability, CVE-2025-8088 in WinRAR. The actor is assessed as Kazakhstan-nexus and active since at least 2020, with overlaps with YoroTrooper, Cavalry Werewolf and Tomiris.
Technical Details
- Spear-phishing emails are sent from compromised government accounts, with diplomatic, trade, energy and aviation lures. Examples include a letter to Armenia's Ministry of Foreign Affairs, a Turkmenistan airspace application form and a business proposal about Russia's Orsk Oil Refinery.
- Four infection chains:
- June 2025: macro-enabled Word documents download and run a second-stage binary.
- July 2025: PS2EXE downloaders fetch reverse-shell payloads and create scheduled tasks for persistence.
- October 2025: an LNK inside a RAR archive launches PowerShell that retrieves a GitHub-hosted script giving remote shell access. Later iterations stage PickleShell in the Windows Startup folder.
- April 2026: a RAR archive exploiting CVE-2025-8088 drops PickleShell in the Startup folder.
- Three public staging directories tied to the actor hosted Linux-compatible tooling and a public proof-of-concept for CVE-2025-25257, a SQL injection flaw in Fortinet FortiWeb. This suggests a possible expansion of capabilities.
- Talos suspects UAT-6275 and YoroTrooper belong to the same broader cluster, but no direct indicator or toolset overlap has been observed.
- VMRay separately reported that Hydra Saiga (the same actor as Comrade Saiga) compromised at least 34 organizations in 8 countries since December 2024, focusing on water-resource infrastructure.
Remediation
The article gives no explicit remediation. The exploited flaw is CVE-2025-8088 in WinRAR, so defenders should ensure WinRAR is patched. They should also watch for Startup-folder persistence, PS2EXE-built binaries, and PowerShell fetching scripts from GitHub.