Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Kazakhstan-linked Silent Lynx spies on Russia's Orsk refinery and regional governments using spear-phishing and lightweight malware.
Cisco Talos and Recorded Future describe Silent Lynx (UAT-6275, TAG-193), a Kazakhstan-nexus espionage group active since at least 2024 against Central Asian governments, diplomatic missions, and civil society. Recent activity targeted Russia's Orsk Oil Refinery and the government of Nizhny Novgorod, using spear-phishing from compromised Tajik and Kyrgyz government accounts and staging on GitHub, Telegram, and hijacked servers. The lightweight toolkit includes PowerShell reverse shells, custom shells in C++, C#, and Go (including PickleShell and Chvost), and commodity tunnels. Researchers cite Astana working hours, Kazakhstan ProtonVPN administration, and rapid VirusTotal uploads from Kazakhstan, while saying motive is unproven.