Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
-
The threat actor tracked as Silent Lynx has been linked to a new campaign targeting government organizations across the Commonwealth of Independent States (CIS). Observed between June 2025 and August 2026, the activity spans four distinct infection chains, giving the group multiple paths into victim environments.
The infection methods include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell payloads, and specially crafted WinRAR archives. The WinRAR component points to exploitation of a WinRAR flaw to deliver a reverse shell, a technique that can provide attackers with persistent remote access once a crafted archive is opened.
- Macro-enabled documents used as initial infection vectors
- PS2EXE downloaders to convert and execute PowerShell scripts
- PowerShell payloads hosted on GitHub
- Crafted WinRAR archives exploiting a WinRAR flaw for reverse shell deployment
Organizations in CIS government sectors should treat these indicators as active threats and review exposure to archive-based delivery and macro-enabled documents in their environments.
Source: The Hacker News
Has your organization reviewed its defenses against macro-enabled documents and crafted archive-based attacks?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login