Actor Profile

Silent Lynx is a Kazakhstan-nexus threat actor active since at least 2020, conducting cyber espionage operations against government organizations across the Commonwealth of Independent States. The group is tracked by multiple vendors under aliases including UAT-6275 (Cisco Talos), TAG-193 (Recorded Future), and shares overlaps with YoroTrooper (Comrade Saiga, ShadowSilk, SturgeonPhisher), Cavalry Werewolf, Tomiris, and Hydra Saiga. The actor demonstrates sustained focus on Central Asian government entities, environmental agencies, economic ministries, and energy infrastructure, reflecting intelligence collection priorities around regional diplomacy and resource management. Hydra Saiga, a related cluster, has compromised at least 34 organizations across 8 countries since December 2024 with reconnaissance extending to over 200 targets globally, with particular emphasis on water resource infrastructure in Central Asia.

TTPs (Tactics, Techniques, Procedures)

Silent Lynx employs spear-phishing emails sent from compromised government accounts containing diplomatic, trade, energy, and aviation-themed lures. The actor utilizes four distinct infection chains: (1) macro-enabled Word documents for second-stage binary delivery, (2) PS2EXE-packaged PowerShell downloaders establishing scheduled task persistence, (3) malicious LNK files in RAR archives launching GitHub-hosted PowerShell scripts with Startup folder persistence, and (4) weaponized RAR archives exploiting CVE-2025-8088 (WinRAR vulnerability) for payload delivery. Post-compromise, the actor deploys custom reverse shells (FoalShell, Chvost, Laplas, PickleShell) for interactive remote access. The group leverages Living-off-the-Land techniques and custom implants written in Rust, Go, and Python. Recent infrastructure analysis reveals Linux-compatible tooling and CVE-2025-25257 (Fortinet FortiWeb SQL injection) proof-of-concept exploits, indicating operational expansion beyond Windows environments.

Targets & Patterns

Silent Lynx concentrates targeting on government organizations across nine CIS countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Specific victim profiles include embassies, government-backed banks, lawyers, think tanks, environmental agencies, economic ministries, and energy infrastructure entities. The targeting pattern reflects intelligence collection priorities centered on regional diplomacy, international trade negotiations, resource management (particularly water resources in Central Asia), and energy sector operations. Lure themes align with victim interests: diplomatic correspondence to foreign ministries, airspace application forms, and business proposals concerning oil refineries. The sustained focus on Central Asian government entities and critical infrastructure suggests strategic intelligence requirements related to regional geopolitics and natural resource control.

Historical Context

Silent Lynx was first publicly documented by Seqrite Labs in early 2025, though the actor has been active since at least 2020. The current campaign spans June 2025 through August 2026, representing at least eight identified operations across the region between January 2025 and May 2026. The actor demonstrates tactical evolution, with April 2026 marking the first observed weaponization of a security vulnerability (CVE-2025-8088) in their delivery methods, representing a shift from purely social engineering-based initial access. The group's relationship to YoroTrooper, ShadowSilk, Cavalry Werewolf, and Tomiris clusters suggests either shared infrastructure, overlapping operational mandates, or umbrella organizational structure, though direct indicator or toolset overlap between UAT-6275 and YoroTrooper has not been definitively established. The Hydra Saiga cluster's December 2024 campaign compromising 34 organizations demonstrates sustained operational tempo and expanding scope.

Defensive Recommendations

  • Monitor for PS2EXE-generated executables and scheduled task creation patterns associated with PowerShell-based persistence mechanisms, particularly tasks executing from user-writable directories
  • Implement detection rules for LNK files within compressed archives that invoke PowerShell with network retrieval capabilities, especially targeting GitHub or other public code repositories
  • Apply patches for CVE-2025-8088 (WinRAR) and CVE-2025-25257 (Fortinet FortiWeb SQL injection) immediately; monitor WinRAR archive extraction for unexpected Startup folder writes
  • Scrutinize emails from government accounts containing diplomatic, trade, or energy-themed attachments, especially macro-enabled documents or RAR archives; validate sender authenticity through out-of-band communication
  • Hunt for custom reverse shell indicators (FoalShell, Chvost, Laplas, PickleShell) and monitor for outbound connections from government workstations to unusual external infrastructure, particularly involving Rust, Go, or Python-based network tools

---

# Geopolitical Context

Geopolitical Context

Silent Lynx, assessed to be a Kazakhstan-nexus threat actor active since at least 2020, has conducted sustained cyber espionage operations against government organizations across the Commonwealth of Independent States from June 2025 through August 2026. The campaign targeted nine countries—Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus—with particular focus on Central Asia. Lure themes centered on diplomatic relations, international trade, energy infrastructure, and aviation suggest intelligence collection priorities aligned with regional diplomacy and resource management. The threat actor's interest in environmental agencies, economic ministries, and water resource infrastructure reflects the strategic importance of transboundary resource governance in Central Asia, where water and energy security remain sources of interstate tension. Silent Lynx shares operational overlaps with clusters tracked as YoroTrooper, ShadowSilk, Cavalry Werewolf, Tomiris, Comrade Saiga, and Hydra Saiga, though direct toolset linkages remain unconfirmed. The use of compromised government email accounts and official-looking documents to conduct spear-phishing operations indicates sophisticated social engineering and prior network access within the region.

State Actor Alignment

Silent Lynx is assessed by multiple threat intelligence firms to be a Kazakhstan-nexus threat actor. The group's sustained targeting of CIS government organizations, diplomatic entities, and critical infrastructure—combined with its focus on regional resource management and economic intelligence—is consistent with state-aligned espionage objectives. The threat actor's use of compromised government accounts for spear-phishing and its focus on diplomatic correspondence suggest access to and interest in information relevant to interstate relations within Central Asia. No public sanctions or formal government attributions have been reported in connection with this activity. The operational tempo and resource investment observed across at least eight campaigns between January 2025 and May 2026 suggest organizational backing beyond typical cybercriminal operations.

Business Impacty pro region

The campaign underscores persistent cyber espionage risks facing governments across the Commonwealth of Independent States, particularly in Central Asia where geopolitical competition over water, energy, and transportation corridors remains acute. The targeting of Armenia and Azerbaijan—states involved in ongoing territorial disputes—alongside Central Asian republics suggests intelligence collection spanning multiple regional fault lines. The threat actor's interest in water resource infrastructure is particularly significant given longstanding tensions between upstream (Kyrgyzstan, Tajikistan) and downstream (Kazakhstan, Uzbekistan, Turkmenistan) states over transboundary river management. For European and transatlantic partners engaged with Central Asian states on connectivity, energy diversification, and governance reform, the campaign highlights the contested information environment in which regional governments operate. The discovery of staging infrastructure hosting Linux tooling and exploits for Fortinet FortiWeb (CVE-2025-25257) may indicate expansion beyond Windows-centric government networks toward enterprise and critical infrastructure targets, potentially broadening the threat surface for international organizations operating in the region.

Forecast

If Silent Lynx maintains its current operational tempo, government organizations across Central Asia and the broader CIS are likely to face continued spear-phishing and exploitation attempts targeting diplomatic, economic, and environmental agencies through at least 2027. The threat actor's April 2026 adoption of CVE-2025-8088 (WinRAR) exploitation—its first observed use of vulnerability-based delivery—suggests an evolving capability set that may incorporate additional N-day or zero-day exploits in future campaigns. If the staging infrastructure hosting Fortinet FortiWeb exploits reflects active capability development, targeting may expand to include enterprise network appliances and web-facing infrastructure beyond traditional endpoint compromise. Organizations in the region should anticipate continued use of compromised government email accounts for social engineering, requiring enhanced email authentication controls and user awareness. If geopolitical tensions over water and energy resources in Central Asia intensify, intelligence collection operations by regional state-aligned actors—including Silent Lynx—are likely to increase in scope and sophistication.