Silent Lynx (tracked as UAT-6275 / TAG-193) spent a year delivering payloads through pure social engineering — macro docs, PS2EXE downloaders, GitHub-hosted PowerShell. In April 2026 it leveled up: a crafted RAR archive exploiting CVE-2025-8088 drops its custom PickleShell reverse shell straight into the Windows Startup folder of CIS government targets. No clicks past the extraction. Five questions to check your exposure.
Key figure: CISA's Known Exploited Vulnerabilities catalog listed 1,748 entries as of October 16, 2026, every one confirmed exploited in the wild (CISA KEV catalog, version 2026.10.16).
Short answer: the flaw is old (fixed in WinRAR 7.13, July 30 2025) and the patch is known — nation-state and criminal actors alike keep exploiting it because unpatched copies persist. If any Windows host in your fleet runs WinRAR older than 7.13, or nobody watches your Startup folders, you're in the blast radius. Check the five below.
Answer for the Windows fleet you defend.
| Fact | Detail |
|---|---|
| Actor | Silent Lynx — Cisco Talos: UAT-6275; Recorded Future: TAG-193. Assessed Kazakhstan-nexus, active since at least 2020; first publicly documented by Seqrite Labs (early 2025). |
| Targets | Government organizations across 9 CIS countries (Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, Belarus) — environmental agencies, economic ministries, energy infrastructure. |
| The flaw | CVE-2025-8088 — path traversal (CWE-35) in Windows WinRAR, CVSS 8.8. Crafted archive writes outside the extraction directory. Discovered by ESET researchers (July 2025); fixed in WinRAR 7.13 (released July 30, 2025); also affects UnRAR.dll and portable UnRAR. |
| The weaponization | April 2026 chain: RAR archive exploiting CVE-2025-8088 drops PickleShell (custom reverse shell) into the Windows Startup folder → executes at next login. First time the group weaponized a vulnerability; prior chains were pure social engineering. |
| Earlier chains | Jun 2025: macro-enabled Word docs. Jul 2025: PS2EXE downloaders + scheduled tasks. Oct 2025: malicious LNK in RAR → GitHub-hosted PowerShell, later also staging PickleShell in Startup. |
| Payload family | Custom reverse shells: FoalShell, Chvost, Laplas, PickleShell — interactive remote access to compromised hosts. |
| Lures | Spear-phishing from compromised government accounts with diplomatic, trade, energy, and aviation-themed decoys (e.g. a diplomatic letter to Armenia's MFA, a Turkmenistan airspace form, a Russia Orsk refinery proposal). |
Source: The Hacker News — "Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks" (Oct 15, 2026), reporting Cisco Talos and Recorded Future Insikt Group research.
WinRAR 7.13+ everywhere. Then hunt for the copies the updater misses: portable WinRAR installs, old UnRAR.dll versions bundled inside third-party software, and gold images still shipping pre-7.13.
Monitor the Windows Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup) and Run registry keys for new files. The whole technique dies if something lands there and you see it first.
Block or sandbox archives from email and messaging; extract untrusted RARs in isolated VMs. The decoy document looks normal — the payload hides in alternate data streams the victim never sees.
EDR rules for outbound reverse-shell connections and unexpected processes spawned at login. PickleShell is custom — signature-only detection will miss it; behavior is what gives it away.
A path-traversal vulnerability (CWE-35, CVSS 8.8) in the Windows version of WinRAR. A crafted archive can write files outside the chosen extraction directory — for example into the Windows Startup folder, where they execute at the next login. Discovered by ESET researchers in July 2025 and fixed in WinRAR 7.13 (released July 30, 2025).
A Kazakhstan-nexus threat actor active since at least 2020, tracked by Cisco Talos as UAT-6275 and Recorded Future as TAG-193. First publicly documented by Seqrite Labs in early 2025, it targets government organizations across the CIS — environmental agencies, economic ministries, and energy infrastructure.
In an April 2026 infection chain, the group used a RAR archive exploiting CVE-2025-8088 to drop PickleShell — a custom reverse shell — into the Windows Startup folder, giving persistence across logins. It was the first time the group weaponized a software vulnerability instead of relying purely on social engineering.
WinRAR 7.13 and later are not vulnerable. But check for shadow copies: older portable UnRAR builds and UnRAR.dll versions bundled inside other software can still be affected, and unpatched hosts elsewhere in the fleet keep the exposure alive.
Update every Windows host to WinRAR 7.13+, hunt Startup folders and Run keys for unknown files, review outbound reverse-shell indicators, and treat untrusted archives — especially from spear-phishing lures — as hostile until verified.
A path-traversal vulnerability (CWE-35, CVSS 8.8) in the Windows version of WinRAR. A crafted archive can write files outside the chosen extraction directory — for example into the Windows Startup folder, where they execute at the next login. Discovered by ESET researchers in July 2025 and fixed in WinRAR 7.13 (released July 30, 2025).
Filed under Cybersecurity News by Ingenious AI — see the related checks above for more in this series.