<![CDATA[Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks]]>The threat actor tracked as Silent Lynx has been linked to a new campaign targeting government organizations across the Commonwealth of Independent States (CIS). Observed between June 2025 and August 2026, the activity spans four distinct infection chains, giving the group multiple paths into victim environments.

The infection methods include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell payloads, and specially crafted WinRAR archives. The WinRAR component points to exploitation of a WinRAR flaw to deliver a reverse shell, a technique that can provide attackers with persistent remote access once a crafted archive is opened.

  • Macro-enabled documents used as initial infection vectors
  • PS2EXE downloaders to convert and execute PowerShell scripts
  • PowerShell payloads hosted on GitHub
  • Crafted WinRAR archives exploiting a WinRAR flaw for reverse shell deployment

Organizations in CIS government sectors should treat these indicators as active threats and review exposure to archive-based delivery and macro-enabled documents in their environments.

Source: The Hacker News

Has your organization reviewed its defenses against macro-enabled documents and crafted archive-based attacks?

]]>https://xploitlk.com/topic/703/silent-lynx-exploits-winrar-flaw-to-deploy-reverse-shell-in-cis-government-attacksRSS for NodeTue, 27 Oct 2026 08:20:38 GMTFri, 16 Oct 2026 04:30:26 GMT60