FoalShell (Malware): news timeline & CVEs

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.

Cisco Talos and Recorded Future attribute attacks from June 2025 through August 2026 to Silent Lynx, tracked as UAT-6275 and TAG-193, against government organizations in Central Asia and the wider CIS. Four infection chains used macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives exploiting CVE-2025-8088. The campaigns deployed custom reverse shells including FoalShell, Chvost, Laplas, and PickleShell, with scheduled tasks or the Startup folder for persistence. Public staging directories also held a proof-of-concept for FortiWeb SQL injection CVE-2025-25257.

The Hacker Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 16:00 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088 CVE-2025-252572· 1 read

TAG-193’s Regional Espionage Operations

TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.

Cisco Talos and Recorded Future’s Insikt Group report sustained espionage by TAG-193, tracked as UAT-6275 and also known as Silent Lynx, against government organizations in Central Asia and the CIS. Campaigns from early 2025 through May 2026 involved entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan, with interests in diplomacy, economics, water, and forestry. Operators phished from compromised government accounts and hosted payloads on GitHub, using LAPLAS, FoalShell, and PowerShell reverse shells. In April 2026 a chain likely aimed at Armenia’s Ministry of Foreign Affairs exploited WinRAR CVE-2025-8088 to drop malware into the Windows Startup folder. A FortiWeb exploit was recovered, but exploitation was not confirmed.

Recorded Futureupdated Oct 15, 18:33 UTC · 1d agofirst Oct 14, 00:00 UTC · 3d agoThreat actor in the wild 6 sources CVE-2025-8088

FoalShell

Timeline2 articles

Related CVEsby mentions

Appears with

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

TAG-193’s Regional Espionage Operations