Silent Lynx espionage campaign exploits WinRAR flaw against nine CIS governments

Joint research from Cisco Talos and Recorded Future Insikt Group, disclosed on October 14, 2026, describes a long running espionage campaign by the group tracked as Silent Lynx, UAT-6275, and TAG-193, assessed as a suspected Kazakhstan nexus actor. Activity observed from June 2025 through August 2026 targeted ministries, diplomatic missions, and civil society organizations in nine Commonwealth of Independent States countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

The campaign used spear phishing and several delivery chains, including crafted RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw fixed in WinRAR 7.13, to deploy custom reverse shells that give the operators interactive remote access.

Sources: The Hacker News; TechTimes