WinRAR flaw CVE-2025-8088 used to plant PickleShell
The WinRAR flaw CVE-2025-8088 was used by the threat actor known as Silent Lynx to install PickleShell on targeted Windows computers. Cisco Talos and Recorded Future’s Insikt Group observed the broader activity from June 2025 through August 2026, identifying four infection routes involving malicious documents, PowerShell-based downloaders, GitHub-hosted code and specially prepared RAR archives.
The attacks ultimately installed FoalShell, Chvost, Laplas or PickleShell. These are custom reverse shells, programs that let an outside operator interact with a compromised computer remotely. Cisco Talos tracks the activity as UAT-6275, while Recorded Future uses the name TAG-193. The researchers found that targeting centred on Central Asia and the wider Commonwealth of Independent States (CIS), with victims or related lure themes covering Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus.
Seqrite Labs first documented Silent Lynx publicly in early 2025, reporting attacks against embassies, lawyers, government-backed banks and think tanks in Kyrgyzstan and Turkmenistan. The group is assessed as having links to Kazakhstan and as having operated since at least 2020. Researchers have associated its activity with tracking clusters and aliases including YoroTrooper, Comrade Saiga, ShadowSilk, SturgeonPhisher, Cavalry Werewolf and Tomiris. UAT-6275 and YoroTrooper are suspected of belonging to a broader common cluster, but researchers have not observed direct overlap in their tools or technical indicators.
VMRay separately reported that Hydra Saiga, another name used for the actor tracked as Comrade Saiga, had compromised at least 34 organizations in eight countries since December 2024. Reconnaissance, meaning information gathering before a possible attack, extended to more than 200 other targets worldwide. The Hydra name reflects the actor’s focus on infrastructure connected to Central Asian water resources. Its operations have combined custom implants written in Rust, Go and Python with Living-off-the-Land techniques, which misuse legitimate tools already installed on a computer.
Across the region, researchers identified at least eight campaigns between January 2025 and May 2026. Spear-phishing messages, which are deceptive emails tailored to a particular recipient, used subjects related to diplomatic relations, international trade, energy and aviation. Some messages came from previously compromised government accounts and carried documents made to look official. Recorded Future cited examples involving a diplomatic letter to Armenia’s Ministry of Foreign Affairs, an application concerning Turkmenistan’s airspace and a proposal connected to Russia’s Orsk Oil Refinery.
The first documented infection route, seen in June 2025, used macro-enabled Word documents. A macro is an automated set of document instructions that can run actions on a computer. In this case, the documents downloaded and executed another malicious program. In July 2025, the attackers moved to downloaders created with PS2EXE, a tool that packages PowerShell scripts as Windows executable files. Those downloaders retrieved reverse-shell payloads and created scheduled tasks so that the malware would continue running over time.
An October 2025 chain placed a malicious Windows shortcut, or LNK file, inside a RAR archive. Opening it started PowerShell, which retrieved and executed a script hosted on GitHub that provided remote shell access. Later versions of this route also downloaded PickleShell and placed it in the Windows Startup folder, causing it to run whenever the user signed in.
In April 2026, Silent Lynx used a crafted RAR archive that exploited CVE-2025-8088 in WinRAR. The archive placed PickleShell directly in the Windows Startup folder. Cisco Talos said this was the first observed UAT-6275 campaign to use a software vulnerability as part of malware delivery, rather than relying only on deceptive files and built-in tools. The campaign reporting does not identify affected WinRAR releases or a fixed version.
Researchers also found three publicly accessible staging directories associated with the actor. They contained tools compatible with Linux and a public proof-of-concept for CVE-2025-25257, an SQL injection flaw in Fortinet FortiWeb. SQL injection is a technique that sends crafted database commands through an application input. The presence of the exploit suggests possible interest in expanding the actor’s capabilities, but the researchers did not say that this FortiWeb vulnerability had been used in the documented compromises.
For website owners and IT teams, the immediate risk described here concerns Windows computers used for everyday work and administration, rather than a vulnerability in a website platform. Unexpected archives, documents and shortcuts can provide an entry point, while persistence in the Startup folder allows malicious software to return after login. Organizations needing assistance with this broader security and infrastructure work can use AEU-I for security-first IT, infrastructure and consulting.
Cisco Talos assessed that the sustained activity and adoption of new delivery methods indicate continued targeting of government organizations in Central Asia and the CIS. The researchers connected the actor’s attention to environmental agencies, economic ministries and energy infrastructure with the value of information about regional diplomacy and resource management.