Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx targets CIS governments using WinRAR flaw and custom reverse shells.
Summary
The threat actor Silent Lynx has been linked to a series of attacks against government organizations in the CIS region between June 2025 and August 2026. These attacks utilize multiple infection chains, including exploiting a WinRAR vulnerability (CVE-2025-8088), to deploy custom reverse shells like FoalShell and PickleShell, enabling remote access to compromised systems. The campaign, tracked as UAT-6275 and TAG-193, shows a focus on Central Asia and includes victims across nine countries.
The lesson from this incident
Full lessonThe Silent Lynx campaign demonstrates the critical danger of leaving known vulnerabilities unpatched in widely-used software like WinRAR, which is prevalent across government and enterprise environments. By exploiting CVE-2025-8088, attackers were able to deploy custom reverse shells (FoalShell and PickleShell), granting persistent remote access to sensitive government networks across nine countries. This matters because archive utilities are often overlooked in patch cycles despite being a common attack vector for initial access. The sustained nature of this campaign — spanning over a year — also highlights failures in detection and response, suggesting compromised environments were not adequately monitored for anomalous outbound connections.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
- cve — CVE-2025-8088
- cve — CVE-2025-25257
- malware — FoalShell
- malware — Chvost
- malware — Laplas
- malware — PickleShell
- malware — PS2EXE