[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzvawHypzOiAamBDPP0aaXWm6JqrpnJMW9Roe8N5JOMY":3},{"article":4,"iocs":53,"watch_terms":73,"solutions":74,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"088d510f-097d-4b78-b893-489836e69745","Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks","silent-lynx-exploits-winrar-flaw-to-deploy-reverse-shell-in-cis-government-attac-c4b792","The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives","The threat actor Silent Lynx has been linked to a series of attacks against government organizations in the CIS region between June 2025 and August 2026. These attacks utilize multiple infection chains, including exploiting a WinRAR vulnerability (CVE-2025-8088), to deploy custom reverse shells like FoalShell and PickleShell, enabling remote access to compromised systems. The campaign, tracked as UAT-6275 and TAG-193, shows a focus on Central Asia and includes victims across nine countries.","Silent Lynx targets CIS governments using WinRAR flaw and custom reverse shells.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fsilent-lynx-exploits-winrar-flaw-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjX-Vi04Qyk2-RKyXrnolcZ8TTBRKY43kIB_B7l-1Na3Xta_ed00DJtXclvIdp65s6Sdf3ksabzWKXmYTmKwx9xAlROi6eas704naXFtyx93xru04krAQ9kViM9rjKSgKhdMR0weIs4xOd7htm_gI_7CLg-N16wjCKt59vAoC-3UpMFJf8QawlMkfpRh745\u002Fs1600\u002Fwinrar-hacker.jpg","2026-10-15T16:00:26+00:00","2026-10-15T18:00:13.774925+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Silent Lynx","threat_actor",{"name":21,"type":19},"YoroTrooper",{"name":23,"type":19},"Comrade Saiga",{"name":25,"type":19},"ShadowSilk",{"name":27,"type":19},"Cavalry Werewolf",{"name":29,"type":19},"Tomiris","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61,64,66,68,70],{"type":55,"value":56,"context":57},"cve","CVE-2025-8088","WinRAR vulnerability exploited by Silent Lynx",{"type":55,"value":59,"context":60},"CVE-2025-25257","SQL injection flaw in Fortinet FortiWeb, potentially used by the threat actor",{"type":47,"value":62,"context":63},"FoalShell","Custom reverse shell deployed by Silent Lynx",{"type":47,"value":65,"context":63},"Chvost",{"type":47,"value":67,"context":63},"Laplas",{"type":47,"value":69,"context":63},"PickleShell",{"type":47,"value":71,"context":72},"PS2EXE","Tool used to package PowerShell scripts as executables for malware deployment",[],{"controls":75,"vendors":160},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":135,"name":136,"problem":137,"products":138},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":156,"product_name":157,"url":158,"description":159},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[161,167],{"slug":162,"name":163,"logo_path":164,"roles":165},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[166],"reported_by",{"slug":168,"name":169,"logo_path":170,"roles":171},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png",[166],{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":188},"silent-lynx-exploits-unpatched-winrar-flaw-to-backdoor-cis-governments","Silent Lynx Exploits Unpatched WinRAR Flaw to Backdoor CIS Governments","The Silent Lynx campaign demonstrates the critical danger of leaving known vulnerabilities unpatched in widely-used software like WinRAR, which is prevalent across government and enterprise environments. By exploiting CVE-2025-8088, attackers were able to deploy custom reverse shells (FoalShell and PickleShell), granting persistent remote access to sensitive government networks across nine countries. This matters because archive utilities are often overlooked in patch cycles despite being a common attack vector for initial access. The sustained nature of this campaign — spanning over a year — also highlights failures in detection and response, suggesting compromised environments were not adequately monitored for anomalous outbound connections.",[177,178,179,180,181,182,183,184,185,186,187],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST SI-4: System Monitoring","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1059: Command and Scripting Interpreter","MITRE ATT&CK T1571: Non-Standard Port",{}]