Cisco Talos and Recorded Future’s Insikt Group say Silent Lynx, also tracked as UAT-6275 and TAG-193, is running four infection chains against CIS government targets, including crafted WinRAR archives that exploit CVE-2025-8088. Those chains have been observed from June 2025 through August 2026 and also use macro-enabled documents, PS2EXE downloaders, and GitHub-hosted PowerShell.
The archive trick matters because it does not stop at opening a file: the crafted WinRAR payload can write a shell into the Windows Startup folder, so the code runs again at login and survives a reboot. The campaign has also delivered FoalShell, Chvost, Laplas, and PickleShell, showing a mixed delivery set rather than a single lure.
For defenders in CIS government and energy networks, the exposure is not just one malicious attachment but a persistence path hidden in ordinary archive handling. If a file can place itself where Windows launches it automatically, cleanup has to account for the startup layer, not only the original delivery method.
CVSS 8.8 HIGH: a path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. EPSS 94% (100th percentile).