Azerbaijan (Country): news timeline & CVEs

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.

Cisco Talos and Recorded Future attribute attacks from June 2025 through August 2026 to Silent Lynx, tracked as UAT-6275 and TAG-193, against government organizations in Central Asia and the wider CIS. Four infection chains used macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives exploiting CVE-2025-8088. The campaigns deployed custom reverse shells including FoalShell, Chvost, Laplas, and PickleShell, with scheduled tasks or the Startup folder for persistence. Public staging directories also held a proof-of-concept for FortiWeb SQL injection CVE-2025-25257.

The Hacker Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 16:00 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088 CVE-2025-252572· 1 read

UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.

Cisco Talos and Recorded Future’s Insikt Group say UAT-6275, also tracked as TAG-193, targeted government organizations across the CIS from June 2025 through August 2026. Since April 2026 the group has abused WinRAR path-traversal flaw CVE-2025-8088 so crafted RAR archives using NTFS alternate data streams drop the PickleShell reverse shell into the user’s Startup folder. Earlier chains used macro-enabled Word documents, PS2EXE downloaders, scheduled tasks, and malicious shortcuts that retrieved payloads from GitHub. Custom shells also include Chvost and Laplas. Talos assesses a Kazakhstan connection with medium confidence and did not confirm in-the-wild FortiWeb exploitation by this actor.

Cyber Security Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 09:08 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Kazakhstan-linked UAT-6275 targeted CIS governments using phishing and a WinRAR exploit.

Cisco Talos and Recorded Future's Insikt Group report that UAT-6275, also tracked as TAG-193, targeted government organizations across the Commonwealth of Independent States from June 2025 through August 2026, with additional interest in water and energy. Four infection chains used macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and a WinRAR archive exploiting CVE-2025-8088, delivering custom reverse shells. Exposed staging directories and a GitHub repository revealed payload builds and command-and-control changes. Talos assesses a Kazakhstan nexus with medium confidence and links the cluster to Silent Lynx and the broader YoroTrooper activity set while tracking them separately.

Cisco Talosupdated Oct 15, 18:33 UTC · 1d agofirst Oct 14, 14:00 UTC · 2d agoThreat actor in the wild 6 sources CVE-2025-8088

Fake GTA 6 leaked copy drains your crypto wallet

A fake GTA 6 leaked-copy website loads a multi-chain crypto wallet drainer that sweeps Solana balances and can steal assets across seven blockchain networks.

A fake Grand Theft Auto VI countdown site offers a supposed leaked copy for $50 or 1 SOL and loads a wallet drainer on page visit. An embedded Solana script transfers nearly the entire wallet balance, while a separate 2.4 MB script built on a legitimate wallet-connector tool targets wallets on Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom, including stablecoins and NFT collections. The drainer geo-blocks CIS countries via a CIS_Protection setting, profiles visitor holdings, and evades automated scanners, suggesting a rented drainer-as-a-service.

Malwarebytes LabsSep 1, 16:07 UTC · Sep 1, 2026Phishing & fraud

Azerbaijan

Timeline4 articles

Related CVEsby mentions

Appears with

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations

Fake GTA 6 leaked copy drains your crypto wallet