Laplas (Malware): news timeline & CVEs

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.

Cisco Talos and Recorded Future attribute attacks from June 2025 through August 2026 to Silent Lynx, tracked as UAT-6275 and TAG-193, against government organizations in Central Asia and the wider CIS. Four infection chains used macro documents, PS2EXE downloaders, GitHub-hosted PowerShell, and WinRAR archives exploiting CVE-2025-8088. The campaigns deployed custom reverse shells including FoalShell, Chvost, Laplas, and PickleShell, with scheduled tasks or the Startup folder for persistence. Public staging directories also held a proof-of-concept for FortiWeb SQL injection CVE-2025-25257.

The Hacker Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 16:00 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088 CVE-2025-252572· 1 read

UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.

Cisco Talos and Recorded Future’s Insikt Group say UAT-6275, also tracked as TAG-193, targeted government organizations across the CIS from June 2025 through August 2026. Since April 2026 the group has abused WinRAR path-traversal flaw CVE-2025-8088 so crafted RAR archives using NTFS alternate data streams drop the PickleShell reverse shell into the user’s Startup folder. Earlier chains used macro-enabled Word documents, PS2EXE downloaders, scheduled tasks, and malicious shortcuts that retrieved payloads from GitHub. Custom shells also include Chvost and Laplas. Talos assesses a Kazakhstan connection with medium confidence and did not confirm in-the-wild FortiWeb exploitation by this actor.

Cyber Security Newsupdated Oct 15, 18:33 UTC · 1d agofirst Oct 15, 09:08 UTC · 1d agoThreat actor in the wild 6 sources CVE-2025-8088

TAG-193’s Regional Espionage Operations

TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.

Cisco Talos and Recorded Future’s Insikt Group report sustained espionage by TAG-193, tracked as UAT-6275 and also known as Silent Lynx, against government organizations in Central Asia and the CIS. Campaigns from early 2025 through May 2026 involved entities in Russia, Tajikistan, Belarus, Armenia, and Uzbekistan, with interests in diplomacy, economics, water, and forestry. Operators phished from compromised government accounts and hosted payloads on GitHub, using LAPLAS, FoalShell, and PowerShell reverse shells. In April 2026 a chain likely aimed at Armenia’s Ministry of Foreign Affairs exploited WinRAR CVE-2025-8088 to drop malware into the Windows Startup folder. A FortiWeb exploit was recovered, but exploitation was not confirmed.

Recorded Futureupdated Oct 15, 18:33 UTC · 1d agofirst Oct 14, 00:00 UTC · 3d agoThreat actor in the wild 6 sources CVE-2025-8088

Laplas

Timeline3 articles

Related CVEsby mentions

Appears with

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations

TAG-193’s Regional Espionage Operations