UAT-6275 Deploys FoalShell, PickleShell via CVE-2025-8088 RAR Archives in Nine CIS States
Silent Lynx expanded operations from embassy phishing to multi-stage WinRAR exploitation against CIS governments, deploying four custom shells while probing FortiWeb flaws. Technical evidence shows no direct tool overlap with YoroTrooper despite thematic convergence on water infrastructure. Continued public exploit hosting signals capability growth that will likely produce measurable FortiWeb scanning spikes by early 2027.
Cisco Talos and Recorded Future tracked the activity as UAT-6275 and TAG-193, documenting macro documents, PS2EXE droppers, GitHub-hosted PowerShell, and LNK-triggered RAR payloads that staged FoalShell, Chvost, Laplas, and PickleShell for interactive access. Publicly accessible staging directories hosted Linux tooling and a FortiWeb CVE-2025-25257 PoC, indicating reconnaissance beyond Windows endpoints. Victim lures referenced diplomatic correspondence, airspace forms, and Russian refinery proposals sent from compromised government mailboxes. Seqrite Labs first named Silent Lynx in early 2025 after Kyrgyzstan and Turkmenistan embassy targeting; overlaps with YoroTrooper, ShadowSilk, and Hydra Saiga clusters remain unlinked by shared indicators despite parallel Central Asian focus. VMRay data shows Hydra Saiga (Comrade Saiga) hit 34 organizations since December 2024 with water-resource reconnaissance extending to 200 additional sites. The actor's shift to public exploit staging and multi-language implants suggests infrastructure reuse across espionage and potential critical-infrastructure mapping. Next campaigns are likely to test the FortiWeb PoC against exposed appliances in Uzbekistan and Kazakhstan within the next 90 days, with persistence via Startup-folder PickleShell copies.
Recorded Future: UAT-6275 will scan FortiWeb instances in Uzbekistan exceeding 50 targets within 90 days
Sources (3)
- [1]Cisco Talos UAT-6275 Report(https://talosintelligence.com/uat-6275-analysis)
- [2]Recorded Future Insikt Group TAG-193(https://recordedfuture.com/insikt/tag-193-cis)
- [3]Seqrite Labs Silent Lynx Profile(https://seqrite.com/labs/silent-lynx-2025)