Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Silent Lynx has been linked to a series of attacks on government organizations in the Commonwealth of Independent States. These attacks, which occurred between June 2025 and August 2026, utilized multiple infection chains. The infection chains involved the use of macro-enabled documents and other tactics. WinRAR archives were also exploited as part of these attacks. The attackers used various tools, including PS2EXE downloaders and PowerShell scripts hosted on GitHub. The attacks demonstrate the threat actor's ability to use diverse methods to target government organizations.