Espionage campaigns hit CIS and Central Asian government targets

· Cybersecurity

Two espionage campaigns against government organizations in the former Soviet space were reported. The threat actor known as Silent Lynx exploited a WinRAR flaw to deploy a reverse shell in attacks on government bodies across the Commonwealth of Independent States, observed from June 2025 through August 2026 and using four infection chains including macro-enabled documents and PS2EXE. Separately, researchers said a roughly two-year-old cyber-espionage campaign against Central Asian states appears to originate in Kazakhstan. Both cases point to sustained, state-linked targeting of government networks in the region, using commodity flaws and varied delivery methods.

Why it matters：State-linked espionage keeps targeting government networks, and the attribution debate over Central Asia shows how contested such findings remain.

Key points

  • Silent Lynx used a WinRAR flaw and four infection chains.
  • It targeted CIS government organizations from June 2025 to August 2026.
  • A separate campaign against Central Asian states is attributed by researchers to Kazakhstan-linked hackers.

Sources (original reporting)

More stories from this day