Silent Lynx, a persistent cyber espionage threat actor, has conducted targeted intrusion campaigns against government ministries, diplomatic missions, and civil society organizations across Central Asia since 2024. The group focuses on high-value public sector organizations in Commonwealth of Independent States countries, leveraging spear-phishing campaigns through compromised government email accounts and malware staging via GitHub. Operations from late 2024 through 2026 reveal extensive infrastructure including exposed open directories, newly registered domains, and GitHub repositories. The actor employs lightweight reverse shells, PowerShell scripts, proprietary tools, and commodity utilities. Recent activity shows adoption of exploit-assisted delivery via CVE-2025-8088, expanding focus on Linux systems, and interest in FortiWeb vulnerability CVE-2025-25257. Attribution indicators point to Russian-speaking operators likely based in Kazakhstan, with targeting concentrated on water resources, environmenta...
