Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Operation Peek-a-Baku: Silent Lynx APT Targets Dushanbe with Espionage Campaign

0
Medium
Published: Wed Nov 05 2025 (11/05/2025, 12:36:24 UTC)
Source: AlienVault OTX General

Description

Operation Peek-a-Baku is an espionage campaign by the Silent Lynx APT group targeting Central Asian nations, Russia, China, and Azerbaijan, with a focus on diplomatic and strategic initiatives in Dushanbe, Tajikistan. The group employs spear-phishing with malicious attachments, PowerShell scripts, . NET implants, and C++ reverse shells to gain persistence and exfiltrate intelligence. They leverage GitHub-hosted payloads and scheduled tasks to maintain access. The campaign targets sensitive information related to diplomatic communications, transportation projects, and summit meetings. Although no CVSS score is assigned, the threat is medium severity due to its espionage nature, targeted scope, and use of sophisticated malware. European organizations involved in diplomatic, infrastructure, or strategic projects linked to Central Asia or Russia may face indirect risks. Mitigation requires targeted email security, endpoint detection focused on PowerShell and . NET anomalies, and monitoring of scheduled tasks and network connections to suspicious external hosts. Countries in Eastern Europe with close ties to Russia and Central Asia, such as Poland, Hungary, and the Baltic states, are more likely to be affected due to geopolitical and strategic linkages.

AI-Powered Analysis

AILast updated: 11/05/2025, 21:39:16 UTC

Technical Analysis

Operation Peek-a-Baku is a targeted espionage campaign conducted by the Silent Lynx APT group, focusing on Central Asian countries including Tajikistan, Russia, China, and Azerbaijan. The campaign has two main thrusts: one targeting Russia-Azerbaijan relations and another focusing on China-Central Asia diplomatic and infrastructure projects. Silent Lynx employs a combination of spear-phishing emails with malicious attachments to deliver payloads such as PowerShell scripts, .NET implants, and C++ reverse shells. These payloads enable remote access, data exfiltration, and persistence through scheduled tasks. The group also uses GitHub-hosted payloads to evade detection and facilitate delivery. The campaign specifically targets intelligence related to diplomatic communications, transportation infrastructure projects, and summit meetings, with a notable focus on events in Dushanbe, Tajikistan. The malware and tactics align with known APT techniques such as T1053.005 (scheduled tasks), T1204.002 (spear-phishing attachments), T1566.001 (phishing), T1071 (application layer protocols), and others, indicating a sophisticated and multi-faceted approach. While no known exploits in the wild are reported, the campaign leverages social engineering and custom malware implants to achieve its objectives. The medium severity rating reflects the targeted espionage impact rather than widespread disruption or destruction.

Potential Impact

For European organizations, the direct impact of Operation Peek-a-Baku is limited due to its regional focus on Central Asia and neighboring countries. However, European entities involved in diplomatic relations, infrastructure projects, or economic partnerships with Central Asia, Russia, or China could be indirectly affected through espionage and intelligence leaks. Compromise of sensitive diplomatic communications or strategic project details could undermine European diplomatic efforts or economic interests. Additionally, European companies with supply chain or operational ties to the targeted regions may face risks of secondary compromise or data exposure. The use of sophisticated malware and persistence mechanisms increases the risk of prolonged undetected access, potentially leading to intellectual property theft or operational disruption. The campaign underscores the importance of securing communications and infrastructure related to international partnerships and geopolitical initiatives.

Mitigation Recommendations

Mitigation should focus on enhancing email security to detect and block spear-phishing attempts, including advanced attachment scanning and URL filtering. Endpoint detection and response (EDR) solutions should be configured to monitor for anomalous PowerShell execution, .NET implant activity, and the creation or modification of scheduled tasks. Network monitoring should include detection of unusual outbound connections, especially to GitHub or other code hosting platforms used for payload delivery. User awareness training must emphasize the risks of spear-phishing and the importance of verifying unexpected attachments or links. Incident response teams should develop playbooks for detecting and responding to reverse shell activity and persistence mechanisms. Organizations should also implement strict application whitelisting and privilege management to limit the execution of unauthorized scripts and binaries. Given the campaign's focus on diplomatic and strategic targets, collaboration with national cybersecurity centers and intelligence sharing within European frameworks can enhance detection and response capabilities.

Need more detailed analysis?Get Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage"]
Adversary
Silent Lynx
Pulse Id
690b44c86b05bcee7cf13cf6
Threat Score
null

Indicators of Compromise

Hash

ValueDescriptionCopy
hash0f59eeca2d63f89b58b10e82bf6beb4e
hash121ed107b6faa57634ea2039e2feba2e
hash123f6b5b0b4220a30cc1605b144ff69e
hash21ea02342c9ab5510201e5776dd518da
hash34b0362734f9d6dc0ed0f2ac5a608e27
hash3552fb1c5a7ef8b30afa3aa1027bd298
hash370462749b58630da5fd712d6e3bb010
hash39142db39eee6eff1cb475dc48167b73
hash39ae2489f83038869780a2b605f60bd8
hash43e21a2f0491be9e5ccb10996f881e8d
hash45eeee7cd7dc978784b27d9ede41960f
hash473949798b06cf667bdd198c894e89a2
hash474f50086754647319f83dd26f529c9b
hash56db53cdaf0f2b4b35a3112d75535fd3
hash597bb85918b54fd31f709b8a2698063a
hash77ef95fbb1df302f18e7de1f74a7e18f
hash8755ecd92984651d3b9faf475024016d
hash888d3a76d4a507159ab27eac808da6a9
hash97fa48a29a56a0e769a21968c9960a26
hasha4840200cdc6fc37beabc18abb061df5
hasha6090aa00565fe33947c749f63b6e9b4
hashac2e8583548212ed89631f2044c1b942
hashb48341c88170b64ae3ff3066a641531a
hashb88da2f6e5e9df5572e9d4dc87ed9f49
hashbc89c56ce3c5ab2895de5c1336a06d34
hashc2cc85e71cd58a78d2c1f336771533a9
hashd5353e6fcc3ff91bb83d7597f02fd0c0
hashfb1a21da08c9dc28c1cb855dce893e9c
hash0e2a1c9508639e5191fbda0f3845b8e78cf4c912
hash188546243a5432ee5f4e9c65abafca4e70db0341
hash1e3ce8fcf11ca3687d665d58d0adbf6862b59c43
hash21d2420cf985eefea68d4748f0a2f1df8b7bae1d
hash27f6457caa686756a9ac7607e738bf6997aa6eb1
hash3af615b7285ac3f56faacc3dabb5def7c90ebe12
hash49df59fe77d9ff204837c8718c58a3b95a685631
hash4c28c1e4803821c0d087e60a3e60f6511ca81256
hash515b78c732ff65e7477669f958a16ebe180ca954
hash69ac8146520acb772a47da9f772b970b08eb5279
hash751cb9ef1de33b0340733400f522fd0792e0fd5d
hash785b8800bca0b82dc4993917ab62802a0d71d40f
hash7d270a8beec7919d9e5d8bb61b8d72ce7209abe5
hash7e68880f4c8c635942b34f7119656c91f5c83183
hash8a4e9fc3c8c1cbc7a3d163757dff844d61c205ca
hash943c27ccbe07e95535e162a3b995e04d7f819c4c
hash9692b70c6b072b6153e490c98360a2ecdbdf0783
hashaa0487872dfae221b627ccd9ae8b633752926a08
hashae17b64ea07a063265d21f3eb2cdec42093c2e0d
hashb38fe3bc82c618cb4a5e93bd4a2ef100499a26ba
hashbd1a023bc171829767ccfd2eb867c2a889a8e11a
hashd3d21d11628a3b277ce28b1aad49690b7c44ed54
hashd47d015903810c7f25d2d4a91c8a31d82198c81e
hashd4bcc524f68bf67844a5daa43cb679ea735566d0
hashe6a15917c49492d332e64b1e50aa23d78e167298
hashf101cb6ac2908095d30cf944fd6aa668a1184a3a
hashf19fe4251f62f0509c84bed3950fb07b9f5e84cb
hashf80a0e833b2c7630b5a50ff24884d7bd0e06af40
hash036a60aa2c62c8a9be89a2060e4300476aef1af2fd4d3dd8cac1bb286c520959
hash0bce0e213690120afc94b53390d93a8874562de5ddcc5511c7b9b9d95cf8a15d
hash123901fa1f91f68dacd9ec972e2137be7e1586f69e419fc12d82ab362ace0ba9
hash1531f13142fc0ebfb7b406d99a02ec6441fc9e40725fe2d2ac11119780995cd3
hash262f9c63c46a0c20d1feecbd0cad75dcb8f731aa5982fef47d2a87217ecda45b
hash26aca51d555a0ea6d80715d8c6a9f49fea158dee11631735e16ea75c443a5802
hash2c8efe6eb9f02bf003d489e846111ef3c6cab32168e6f02af7396e93938118dd
hash303f03ae338fddfe77c6afab496ea5c3593d7831571ce697e2253d4b6ca8a69a
hash32035c9d3b81ad72913f8db42038fcf6d95b51d4d84208067fe22cf6323f133c
hash40d4d7b0bc47b1d30167dd7fc9bd6bd34d99b8e0ae2c4537f94716e58e7a5aeb
hash5b58133de33e818e082a5661d151326bce5eeddea0ef4d860024c1dbb9f94639
hash5bae9c364ee4f89af83e1c7d3d6ee93e7f2ea7bd72f9da47d78a88ab5cfbd5d4
hash5e3533df6aa40e86063dd0c9d1cd235f4523d8a67d864aa958403d7b3273eaaf
hash67cf0e32ad30a594442be87a99882fa4ac86494994eee23bdd21337adb804d3f
hash6cb54ec004ff8b311e73ef8a8f69b8dd043b7b84c5499f4c6d79d462cea941d8
hash72a36e1da800b5acec485ba8fa603cd2713de4ecc78498fcb5d306fc3e448c7b
hash821f1ee371482bfa9b5ff1aff33705ed16e0147a9375d7a9969974c43b9e16e8
hash97969978799100c7be211b9bf8a152bbd826ba6cb55377284537b381a4814216
hash9de8bbc961ff450332f40935b739d6d546f4b2abf45aec713e86b37b0799526d
hasha639a9043334dcd95e7cd239f8816851517ebb3850c6066a4f64ac39281242a3
hasha83a8eb3b522c4517b8512f7f4e9335485fd5684b8653cde7f3b9b65c432fa81
hashae51aef21ea4b422ef0c7eb025356e45d1ce405d66afbb3f6479d10d0600bcfd
hashb0ac155b99bc5cf17ecfd8d3c26037456bc59643344a3a30a92e2c71c4c6ce8d
hashb58f672e7fe22b3a41b507211480c660003823f814d58c04334ca9b7cdd01f92
hashb5a4f459bdff7947f27474840062cfce14ee2b1a0ef84da100679bc4aa2fcf77
hashb87712a6eea5310319043414eabe69462e12738d4f460e66a59c3acb5f30e32e
hashef627bad812c25a665e886044217371f9e817770b892f65cff5877b02458374e
hashffda4f894ca784ce34386c52b18d61c399eb2fc8c9af721933a5de1a8fff9e1b

Ip

ValueDescriptionCopy
ip37.18.27.27
ip62.113.66.137
ip62.113.66.7

Domain

ValueDescriptionCopy
domainboxter.50066.sl
domaincatalog-update-update-microsoft.serveftp.com
domainupdates-check-microsoft.ddns.net

Threat ID: 690bc2866ab8174a0d402f55

Added to database: 11/5/2025, 9:32:54 PM

Last enriched: 11/5/2025, 9:39:16 PM

Last updated: 11/6/2025, 9:27:24 AM

Views: 9

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need enhanced features?

Contact root@offseq.com for Pro access with improved analysis and higher rate limits.

Latest Threats