Decoding CVE-2025-8088: How APT Silent Lynx turns WinRAR file compression feature into a system hijacking backdoor

Campaign Summary

In October 2026, the security research team from Cisco Talos and Recorded Future Insikt Group published a detailed report on the cyber espionage campaign lasting from June 2025 to August 2026 of the Silent Lynx cyber spy group (identified by Cisco Talos as UAT-6275, tracked by Recorded Future under code TAG-193). The campaign's central targets are government agencies in charge of diplomacy, international trade, water security and the energy complex in nine countries of the Commonwealth of Independent States (CIS), including Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.

The campaign recognized a landmark change in Silent Lynx's technical capabilities: after nearly two years of relying solely on social engineering and document macros, in April 2026 the group for the first time weaponized an N-day security vulnerability, specifically the path traversal vulnerability - CVE-2025-8088 (CVSS 8.8) in WinRAR file compression software. This exploit allows hackers to silently drop a reverse shell malware written in Python called PickleShell directly into the victim's Windows Startup folder, gaining control of server/workstation interaction as soon as the user logs back in, without needing to enable macros or grant administrator rights.

However, the entire C2 infrastructure, payload distribution chain, and geographical origin of the group were exposed by a series of elementary operational security (OPSEC) mistakes: misconfiguration to publicly open 3 staging folders on the C2 server, revealing commit history on GitHub with UTC + 5 (Astana) standard business hours, administrative connection from a VPN address located in Kazakhstan, and the act of uploading malware samples to VirusTotal after only 86 seconds from the time of compilation.

Hacker Profile

Silent Lynx was first publicly documented by Seqrite Labs in early 2025 (Silent Lynx APT Targets Kyrgyzstan & Neighbors | Seqrite) through attacks targeting embassies, law offices, state banks, and policy research institutes in Kyrgyzstan and Turkmenistan. Further investigations by Cisco Talos and Recorded Future determined the group had maintained silent espionage operations since at least 2020.

The threat intelligence community (CTI) identifies Silent Lynx as having a close connection to famous attack clusters in the Central Asia region:

• YoroTrooper (Comrade Saiga / SturgeonPhisher): Appears since 2022, specializes in stealing diplomatic data in CIS and Europe. Although they do not directly share C2 hashes or IP ranges with Silent Lynx, the two groups share high similarities in targets and spear-phishing themes.

• Hydra Saiga: The operational cluster was reported by VMRay in early 2025 after infiltrating at least 34 organizations in 8 countries. This cluster has an intense focus on irrigation agencies and freshwater infrastructure - exactly coincident with Silent Lynx's targeting of environmental resources agencies in Armenia and Uzbekistan.

• Tomiris & Cavalry Werewolf: Spy groups thoroughly exploit trusted relationships, abusing government email accounts to spread malware.

Silent Lynx's operational characteristic is pragmatism: it does not invest in developing malware frameworks that are too complicated or cost millions of dollars like Tier-1 groups, but focuses on streamlined reverse shells (PowerShell, Python, Go, C#), taking advantage of trusted public cloud infrastructure (GitHub, Telegram) and appropriating legitimate government email accounts for fraud.

Timeline of Events and Geopolitical Context

Telemetry data shows that Silent Lynx deployed at least eight separate attack campaigns between January 2025 and August 2026. Notably, the attack timelines closely align with the diplomatic upheavals and energy incidents in the region:

Strategic goal context:

1. Kazakhstan-Tajikistan Alliance Treaty (March 2026): Telemetry of network traffic recorded a Tajikistan government agency server connecting to Silent Lynx's server just a few days after the Kazakh House of Representatives ratified the Alliance Relations Treaty.

2. Kazakhstan - Belarus Diplomatic Talks (April 2026): A Belarusian government entity appeared on Silent Lynx's C2 infrastructure exactly one week before the Belarusian Foreign Minister's trip to Astana to meet with the President of Kazakhstan.

3. Orsk Oil Refinery (Russia): Located in the Orenburg region close to the Kazakhstan border (25 km away), Orsk is an important source of petroleum products for northern Kazakhstan. In August 2025, Silent Lynx used a decoy document, a letter of proposal for cooperation between Turkmenistan National Oil and Gas Corporation (Turkmennebit) and the Orsk Factory leadership. Exactly one year later (August 2026), this factory was attacked by unmanned aerial vehicles (UAVs), causing oil refining operations to stagnate for many months, placing severe energy security pressure on Kazakhstan's supply chain.

4. Water resource infrastructure and the Caspian Sea basin: The group targets the Nizhny Novgorod city government (the intersection of the Volga and Oka rivers, a vital route to the Caspian Sea) and the Smart Forestry initiative in Uzbekistan, reflecting the motive of gathering intelligence to serve the problem of freshwater scarcity in Central Asia.

Architecture of 4 Chains of Infection

• Series A (June 2025): Traditional method uses Microsoft Word files with malicious VBA macros. When the user clicks Enable Content, the macro triggers a call to PowerShell or the Windows API to download the executable binary payload. The weakness of this chain is Microsoft's default macro blocking policy for files downloaded from the Internet (Mark of the Web - MotW), causing the success rate to decrease.

• Sequence B (July 2025): Attackers turn to the PS2EXE utility — an open source tool that allows compiling PowerShell scripts into standalone executable files (.exe). This method helps bypass the signature scanning mechanism of basic anti-virus software for .ps1 files. After running, Binary will set up a Windows Scheduled Task to maintain persistent access.

• Series C (October 2025): Silent Lynx sends a compressed file containing a .lnk shortcut file that disguises the office document icon. When the victim clicks open, the command embedded in the LNK file activates the underground powershell.exe process, accessing a public repository on GitHub controlled by the group to pull in the malicious code. In later variants of the C sequence, the script has been known to copy itself to the PickleShell malware into the Windows Startup folder.

• Series D (April 2026): This is the group's most dangerous leap. Instead of relying on tricking victims into clicking on shortcut files or enabling macros, the team created a custom RAR archive that directly exploits the WinRAR vulnerability CVE-2025-8088. The victim only needs to decompress the file with the vulnerable version of WinRAR, the payload will automatically be overwritten outside the destination folder, falling straight into the system's boot location.

Technical Anatomy of WinRAR Exploitation CVE-2025-8088

The vulnerability CVE-2025-8088 is a lax path traversal error in the handling of Alternate Data Streams (ADS) on the NTFS file system when decompressing RAR archives. The vulnerability was discovered by security firm ESET when the spy group RomCom (UNC4895) used it as a zero-day in mid-July 2025, before software firm RARLAB released an official patch in version WinRAR 7.13 on July 30, 2025.

Specification CVE-2025-8088

• CVE Identifier: CVE-2025-8088

• CVSS v3.1 score: 8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Weakness (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory

• Exploitation mechanism: NTFS Alternate Data Streams (ADS) & Path Traversal Injection

• Affected versions: RARLAB WinRAR < 7.13 on Microsoft Windows platforms

• Fix version: WinRAR 7.13 (Released on July 30, 2025)

In-depth technical mechanism

On the Windows NTFS file system, the Alternate Data Streams (ADS) feature allows multiple data streams to be attached to a single file according to the syntax: name_tap_tin.ext:name_luong_du_lieu

Normally, the decompressor must filter out or sanitize special characters (:, , /, ..) in the file header of each file within the archive. In WinRAR versions before 7.13, the file extraction path parsing function incorrectly handled relative path nested ADS syntax.

The attacker creates a malicious RAR archive consisting of 2 elements:

1. A valid bait file (e.g. PDF document named Deystvuyushchie_tarify.pdf - Current fee schedules).

2. A specially formatted hidden file structure pointing to the substream with a directory escape sequence:

• Deystvuyushchie_tarify.pdf:..\..\..\..\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PickleShell.exe

• Deystvuyushchie_tarify.pdf:..\..\..\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update_checker.exe

When the user extracts the decoy file using WinRAR:

• The WinRAR interface displays the normal process of extracting PDF files to the current directory (for example: C:\Users\Victim\Downloads).

• However, WinRAR's decoder logic was fooled by the ADS sequence, causing the file pointer to break out of the download directory through the ..\ characters.

• The binary stream containing the executable payload is written directly to the user's startup directory: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\PickleShell.exe

This technique completely eliminates the dependence on the victim's careless interaction (such as clicking on an unfamiliar executable file or enabling dangerous macros). The victim completely believed that he had just opened a normal PDF document, but in fact the malicious code was lying around ready to launch during the next login session.

Malware Arsenal: PickleShell, Chvost, Laplas and FoalShell

Silent Lynx does not use expensive or cumbersome commercial C2 frameworks. Instead, the team operates a collection of self-written backdoors and reverse shells that are small in size and minimal in functionality to reduce the possibility of detection by EDR.

PickleShell Backdoor

PickleShell is the main weapon deployed in both Series C and Series D:

• Architecture: Written in Python, then packaged into a PE Windows binary file (.exe) through packaging tools such as PyInstaller or cx_Freeze to run independently without requiring the victim machine to have Python Runtime pre-installed.

• Identification fingerprint (PDB String): Decompilation analysts found a unique compile path string (PDB) inside the binary: C:\Users\pickl\Desktop\tools\PickleShell\dist\client.pdb

In particular, in the decoy PDF document with the theme of oil and gas cooperation with the Orsk Factory discovered in August 2025, the author metadata field shows the string pickle rick — created just 1 hour after the PickleShell payload was compiled, proving author uniformity.

• Mechanism of action: After being loaded into memory, PickleShell establishes a reverse connection socket (Reverse TCP) to the hacker's C2 server. It directly forwards the stdin/stdout/stderr stream of the cmd.exe command line process, allowing the attacker to control the victim's computer in real time. In addition, the malware supports basic file transfer functions (upload/download binary files).

Chvost and Laplas

• Chvost: Reverse shell line written in C++/C#, serving as a backup when the target environment restricts PowerShell or detects processes born from Python.

• Laplas: Tool to support system reconnaissance and internal proxy setup, helping the team expand the scope of reconnaissance to other network segments.

Expanding your arsenal to Linux and Edge Appliances

When exploring open staging folders on Silent Lynx's C2 server, researchers discovered that the group was actively preparing tools for targets running Linux operating systems and edge network devices:

• Linux-compatible binary ELF files (reverse shell written in Go and Python).

• Publicly available Proof-of-Concept for vulnerability CVE-2025-25257 — critical SQL Injection vulnerability in Fortinet FortiWeb web application firewall appliance. This proves that Silent Lynx is planning to expand its focus to network edge devices to establish an initial intrusion springboard to replace phishing emails.

Operational Security Mistakes (OPSEC Blunders) Exposing Attack Groups

Despite obvious advances in malware distribution techniques, Silent Lynx revealed elementary vulnerabilities in operational security (OPSEC). It was these errors that provided Cisco Talos and Recorded Future with irrefutable evidence to expose the entire campaign:

Open Staging Directories configuration

The attack group configured carelessly on the C2 web server, leaving 3 staging directories open allowing anyone to browse the file index (Directory Listing). Thanks to that, analysts downloaded all new malware versions in development, tool catalogs, internal scripts and even the attacker's own console command line history.

Russian keyboard typing error in command history (Typo Artifact)

In a log file recording shell command history recovered from the C2 server infrastructure, the analysis team discovered a silly command line: црщфьш

When decoding characters on a computer keyboard: the Russian character string ц-р-щ-ф-ь-ш corresponds 100% accurately to the w-h-o-a-m-i keys on the standard English keyboard layout (QWERTY Latin). This happened when the team's technician wanted to type the whoami command but forgot to convert Cyrillic to Latin — strong evidence that the operator was a native Russian user.

Analyzing working hours across 77 GitHub Commits

Silent Lynx hosts the script code on a public GitHub repository. Analyzing the timestamps of 77 commits on this repository shows:

• 95% of commits took place exactly during office hours from 09:00 to 18:00 in the UTC+5 time zone (Time zone of the capital Astana, Kazakhstan).

• When comparing this same data set with the Moscow time zone (UTC+3), the percentage of commits falling during business hours only reached 51%. This distribution proves that malware development activities are professionally organized during business hours in the Kazakhstan region.

Traces of malicious code testing on VirusTotal (VT Uploads)

The act of testing the malware's stealth capabilities before attacking directly betrayed the group's geographical location:

• A sample of Chvost malware that had just been compiled was uploaded to the VirusTotal platform for detection testing in just 86 seconds.

• A second malicious code sample was also uploaded to VirusTotal after only 4 minutes of compilation.

• All requests to download this file come from the source IP address in Kazakhstan. Notably, this same uploader account had previously posted many specific reconnaissance tools that had appeared in Silent Lynx campaigns.

Egress ProtonVPN IP address

Remote administration connection sessions to Silent Lynx's C2 server all go through the egress IP nodes of the ProtonVPN service located in Kazakhstan. These sessions take place consistently on weekdays from Monday to Friday, between 07:00 and 12:00 noon local time.

ATT&CK Mapping

Tactic	Technique (ID + Name)	Behavior
Initial Access	T1566.001 — Spearphishing Attachment	Spear-phishing emails carrying malicious attachments (Word, RAR, LNK)
	T1566.002 — Spearphishing Link	Spear-phishing emails with links that download malware from GitHub
	T1190 — Exploit Public-Facing Application	Exploit the N-day WinRAR flaw CVE-2025-8088 and prepare a FortiWeb PoC
Execution	T1204.002 — Malicious File	Victim extracts the RAR archive or clicks the malicious .LNK shortcut
	T1059.001 — PowerShell	Use PowerShell to run scripts downloaded from a remote server
	T1059.005 — Visual Basic	Execute VBA macro code embedded inside an Office document
Persistence	T1547.001 — Registry Run Keys / Startup Folder	Drop PickleShell into the Startup folder (%APPDATA%\...\Startup)
	T1053.005 — Scheduled Task	Create a Scheduled Task to auto-launch a PS2EXE-compiled payload
Defense Evasion	T1027 — Obfuscated Files or Information	Package the PowerShell script into a PE file using PS2EXE
	T1036.005 — Match Legitimate Name or Location	Set file names and icons to impersonate legitimate office documents
	T1564.004 — NTFS File Attributes	Abuse NTFS Alternate Data Streams (ADS) to hide the payload
Discovery	T1082 — System Information Discovery	Collect OS configuration via commands such as whoami, systeminfo
	T1083 — File and Directory Discovery	Search the workstation for sensitive documents
Command & Control	T1071.001 — Web Protocols	C2 over web protocols using public infrastructure (a GitHub repository)
	T1095 — Non-Application Layer Protocol	Establish a non-application-layer connection (a raw TCP shell)
	T1105 — Ingress Tool Transfer	Download later stages from the staging server

IOCs

The startup folder contains malicious code

• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\PickleShell.exe

• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\update_checker.exe

PDB identifier string in binary

• C:\Users\pickl\Desktop\tools\PickleShell\dist\client.pdb

Malicious decoy document metadata

• Author: "pickle rick"

• Subject: "Деловое предложение о сотрудничестве между ГК «Туркменнебит» и руководством Орского НПЗ"

File Hashes

• e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

• 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

• 7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730

• d41d8cd98f00b204e9800998ecf8427e

ClamAV identification signature

• Win.Backdoor.PickleShell-10060602-0

• Win.Backdoor.Chvost-10060603-0

• Win.Malware.Generic-10060604-0

• Win.Malware.LAPLAS-10060605-0

• Win.Malware.LAPLAS-10060606-0

• Win.Proxy.Generic-10060628-0

Expert Comments FPT IS SOC

From the perspective of the threat analysis team at FPT IS SOC, Silent Lynx's campaign reflects three profound tactical trends that are shaping the regional cybersecurity picture:

The rise of Tier-2 Regional APTs

The world of cyber espionage is no longer the exclusive playground of major technology powers. Mid-range countries are promoting the building of independent cyber attack capabilities to directly serve foreign interests, trade negotiations and vital resource security (energy and water resources). Silent Lynx's collection of information about the Orsk oil refinery or bilateral treaties shows that the cyber warfare network is becoming a strategic support tool for national foreign policy.

The deadly danger of N-day vulnerabilities in utility software

A worrying fact is that basic office utility software such as WinRAR, 7-Zip, Notepad++ are often forgotten in businesses' patch management policies. The vulnerability CVE-2025-8088 has been patched since July 2025, but as of April 2026, Silent Lynx was still exploiting it with great success on a large scale. According to actual tracking data from our SOC projects in Vietnam, the percentage of workstations in financial institutions and large businesses with outdated WinRAR versions (versions 5.x, 6.x) is up to more than 45%. This is "fertile ground" for attack groups to take advantage of to bypass email gateway and EDR protection layers.

The Paradox Between N-day Weaponization and Poor OPSEC Capability

Silent Lynx represents a generation of dangerous but careless hackers: capable of monitoring the underground market, acquiring or learning N-day exploit PoC very quickly to put into combat, but the operational safety process (OPSEC) is full of amateur errors. However, defense organizations are not allowed to be subjective: even though the hackers revealed their traces, once the PickleShell malware landed in the Startup folder and activated the shell, the attacker completed the goal of stealing data before being detected.

Defense Recommendations

Urgent action (0 - 24 hours)

• Update WinRAR: Force update all workstations and servers installing WinRAR to WinRAR version 7.13 or higher. For systems that cannot be updated immediately, consider uninstalling WinRAR and temporarily using Windows 11's built-in archiver or alternative open source solutions with centralized management policies.

  • WinRAR News: WinRAR 7.13 Final released

• Check the Startup folder: Run PowerShell commands on the entire workstation via GPO or EDR to detect unusual files in the startup folder:

  • Get-ChildItem -Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup", "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" -Recurse | Select-Object FullName, CreationTime, Length

• Deploy network rules: Immediately update Snort signatures (11192, 15306, 46983, 47398) on the IPS/firewall system at the gateway to block C2 connections of PickleShell and Chvost.

Short-term measures (1 - 7 days)

• Enable Attack Surface Reduction (ASR) rules: Enable Microsoft Defender for Endpoint ASR rules:

  • Block executable content from email client and webmail (GUID: be9ba2d9-53ea-44a7-8f61-bd4c460e9a7b)

  • Block Win32 API calls from Office macros (GUID: 92e97aa1-0314-4916-a36f-65b2e0480744)

  • Block executable files from running unless they meet a prevalence, age, or trusted list criterion

• Threat Hunting: Queries the EDR/Sysmon log (Event ID 1) looking for unusual behavior when WinRAR creates files in the system directory:

  • DeviceFileEvents

    | where InitiatingProcessFileName =~ "winrar.exe"

    | where FolderPath has_any (@"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup", @"\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup")

    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath

Long-term strategy

• Automate software lifecycle management: Bring third-party applications such as extractors, PDF readers, browsers into automated patch management systems (e.g. Microsoft Intune, SCCM, ManageEngine).

• Outbound connection control (Egress Filtering): Strict network partitioning; Block internal servers and workstations that do not need to directly access strange Raw TCP ports or source code hosting services such as GitHub without going through an authenticated proxy.

References

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Hydra Saiga: Covert Espionage and Infiltration of Critical Utilities

Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government