Analysis reveals details on Silent Lynx campaigns targeting CIS government organizations using four distinct infection chains, including macro documents, GitHub-hosted PowerShell, and CVE-2025-8088 exploits to deploy custom reverse shells.
How attacks are carried out
Attacks typically begin with emails sent from compromised government accounts. These emails contain documents related to diplomatic matters, international trade, energy, and aviation, to make them appear convincing to recipients.
Researchers identified four different methods used by the perpetrators from June 2025 to August 2026. Among other things, they used documents with hidden automated programs, special downloaders, hidden scripts on online code hosting platforms, as well as compressed files that exploited security vulnerabilities in popular file management programs.
What is the consequence?
When users opened the infected files, the attackers installed programs that gave them remote control over the victims' computers. These attacks used tools such as FoalShell, Chvost, Laplas, and PickleShell, which were often placed in Windows startup folders to automatically launch each time the computer was turned on.
READ ALSO
Al Jazeera employees' devices infected with spyware via simple ads
Which organizations are affected?
The group's targets have been ministries, embassies, banks, lawyers, research centers, and infrastructure related to energy and water resources management.
Cybersecurity companies monitoring the case estimate that the group is linked to activity recorded since 2020 and continues to pose a threat to government services in the region.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)