WinRAR CVE-2025-8088 Flaw Powers Silent Lynx CIS Government Hack via Phishing Lures

Silent Lynx gained interactive remote access to compromised hosts by deploying custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. To achieve this, the threat actor needed to deliver malicious payloads through spear-phishing emails containing decoy documents. These lures focused on themes like diplomatic relations, international trade, energy, and aviation to entice victims within government organizations across the Commonwealth of Independent States.

How it unfolded

• Activity began in June 2025, with Silent Lynx launching attacks against government organizations across the CIS region.
• The campaign continued through August 2026, utilizing four different infection chains including macro-enabled documents and PS2EXE downloaders.
• Attackers employed GitHub-hosted PowerShell scripts and crafted WinRAR archives to exploit CVE-2025-8088 and establish persistent access.

Who is affected

The attacks concentrated on Central Asia and the wider CIS region, impacting victims in nine countries. According to security researcher Ashley Shen, observed targets spanned Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus. Silent Lynx was first documented by Seqrite Labs in early 2025, highlighting attacks on embassies, lawyers, government-backed banks, and think tanks. The group is assessed as a Kazakhstan-nexus actor active since at least 2020, sharing overlaps with clusters like YoroTrooper and ShadowSilk.

The fix

No confirmed patch or update for CVE-2025-8088 is mentioned in the source material. Organizations should monitor vendor advisories for remediation guidance regarding this specific WinRAR vulnerability until an official fix is released.

What made it possible

Remote code execution flaws in archive utilities allow attackers to bypass standard security controls by embedding malicious code within seemingly benign files. This technique serves the initial access phase of an intrusion, enabling adversaries to execute arbitrary commands on compromised systems. Teams usually mitigate such risks by restricting the use of executable macros and validating file sources before opening attachments. Check whether endpoint detection tools are configured to block unauthorized script execution from compressed archives.

What to do and how to stay safe: Silent Lynx

• Monitor network traffic for unusual outbound connections that may indicate reverse shell activity.
• Review email logs for attachments with themes related to trade, energy, or diplomacy from unknown senders.
• Ensure endpoint protection is updated to detect known reverse shells like FoalShell and Chvost.
• Restrict the execution of PowerShell scripts from untrusted sources such as public repositories.

Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What vulnerability did Silent Lynx exploit in this campaign?

Silent Lynx exploited CVE-2025-8088, a flaw in WinRAR, to deploy reverse shells and gain remote access.

Which countries were targeted by these attacks?

The campaign affected government organizations in Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus.

What tools did the attackers use to maintain access?

The threat actor deployed custom reverse shells named FoalShell, Chvost, Laplas, and PickleShell to facilitate interactive remote access.