BREAK THE SILENCE: Tracking Silent Lynx Through Exposed Infrastructure

Silent Lynx is a persistent cyber espionage group active since 2024, targeting government ministries, diplomatic missions, and civil society organizations primarily in Central Asia and Commonwealth of Independent States countries. The group uses spear-phishing via compromised government email accounts and stages malware on GitHub repositories. Their operations involve exposed infrastructure such as open directories and newly registered domains. They employ a mix of lightweight reverse shells, PowerShell scripts, proprietary tools, and commodity utilities. Recent activity includes exploitation attempts using CVE-2025-8088 and interest in FortiWeb vulnerability CVE-2025-25257, with an expanded focus on Linux systems. Attribution suggests Russian-speaking operators likely based in Kazakhstan, targeting critical sectors like water resources and environmental organizations.

• Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257) - watchTowr LabsExploitedVulnerability2025-07-11
• RARLAB WinRAR · Gorbag: Orcs at the border harvesting intelligence from UkraineExploitedMalware2026-11-03
• SUSE · clamav-1.5.4-1.1 on GA mediaExploitedVulnerability2026-08-24
• SUSE · Security update for clamavExploitedVulnerability2026-09-14
• SUSE · Security update for clamavExploitedVulnerability2026-09-11