Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been linked to a new wave of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The campaign, observed between June 2025 and August 2026, leverages four distinct infection chains. These include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell scripts, and crafted WinRAR archives exploiting a known WinRAR vulnerability. The attacks aim to deploy reverse shells, enabling persistent remote access to compromised systems. The use of multiple infection vectors suggests a sophisticated and adaptable threat actor. The targeting of CIS government entities indicates likely espionage motivations. The exploitation of WinRAR flaws combined with living-off-the-land techniques makes detection challenging.