---
title: 'Silent Lynx espionage campaign exploits WinRAR flaw against nine CIS governments'
url: 'https://securteksecurity.com/news/silent-lynx-espionage-winrar-flaw-cis-governments'
markdown: 'https://securteksecurity.com/news/silent-lynx-espionage-winrar-flaw-cis-governments.md'
date: '2026-10-15'
description: 'Joint research from Cisco Talos and Recorded Future Insikt Group, disclosed on October 14, 2026, describes a long running espionage campaign by the group tracked as Silent Lynx, UAT-6275, and TAG-193, assessed as a suspected Kazakhstan nexus actor. Activity observed from June 2025 through August 20…'
taxonomy:
  category:
    - Cybersecurity
---

# [Silent Lynx espionage campaign exploits WinRAR flaw against nine CIS governments](https://securteksecurity.com/news/silent-lynx-espionage-winrar-flaw-cis-governments)

   15th Oct 2026  

Joint research from Cisco Talos and Recorded Future Insikt Group, disclosed on October 14, 2026, describes a long running espionage campaign by the group tracked as Silent Lynx, UAT-6275, and TAG-193, assessed as a suspected Kazakhstan nexus actor. Activity observed from June 2025 through August 2026 targeted ministries, diplomatic missions, and civil society organizations in nine Commonwealth of Independent States countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

The campaign used spear phishing and several delivery chains, including crafted RAR archives exploiting CVE-2025-8088, a WinRAR path traversal flaw fixed in WinRAR 7.13, to deploy custom reverse shells that give the operators interactive remote access.

Sources: [The Hacker News](http://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html); [TechTimes](https://www.techtimes.com/articles/329126/20261016/kazakhstans-silent-lynx-hacked-nine-cis-governments-using-winrar-exploit-cisco-talos-finds.htm)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [ShopServe breach in Japan exposes about 23.36 million customer records](https://securteksecurity.com/news/shopserve-estore-breach-2336-million-customer-records.md)
- Next: [Skyticket breach scope expands: bank account and card data categories added](https://securteksecurity.com/news/skyticket-breach-expands-bank-account-card-data-categories.md)