Silent Lynx Exploits WinRAR Flaw in CIS Government Attacks
The threat actor Silent Lynx has been linked to attacks on government organizations across the CIS from June 2025 to August 2026, using four infection chains that deploy a reverse shell via macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives.
- Attacks ran from June 2025 through August 2026
- Four distinct infection chains were used
- Tactics included macros, PS2EXE, GitHub and WinRAR archives
- Targets were government organizations across the CIS
Read next
Security