Skip to navigation

Threat reportAPTTL-2026-5756

Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures

highACTIVE

CloudSEK analysed an exposed open directory belonging to a Silent Lynx operator, a Central Asia-focused espionage cluster. It held Laplas/Chvost implants, data from intrusions into Tajik and Uzbek government and critical infrastructure, and logs of an AI agent (Hermes, persona 'Strix') the operator used to run operations through October 2026. First disclosed .

Key facts

IdentifiersTL-2026-5756, CVE-2025-8088
Also known asOff the Rails, Operation Peek-a-Baku (prior campaign)
SeverityHIGH
First disclosed
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2025-8088 (added )
EPSSCVE-2025-8088: 94.2% (99.8th percentile)
Affected productsTajikistan State Railway Railway corporate network (Active Directory domain); Tajikistan Government EDO national document exchange platform; Uzbekistan Smart Forestry GeoServer with PostgreSQL backend; Microsoft Windows Server 2008 R2 (MS17-010 targeted); RARLAB WinRAR (CVE-2025-8088, per Talos for the cluster)
Weaknesses (CWE)CWE-35
AttributionYoroTrooper (medium confidence)
Nation-state nexusKazakhstan
MalwareChvost, Laplas (Reverseshell), Responder, Tomiris - S0671
ToolsGOST, Hermes agent (Strix), Impacket - S0357, Ligolo-mp, metasploit
MITRE ATT&CK techniquesT1003.003 NTDS, T1036.004 Masquerade Task or Service, T1039 Data from Network Shared Drive, T1046 Network Service Discovery, T1053.003 Cron, T1059.001 PowerShell, T1070.003 Clear Command History, T1078 Valid Accounts, T1090.003 Multi-hop Proxy, T1102.002 Bidirectional Communication, T1190 Exploit Public-Facing Application, T1204.002 Malicious File and 7 more in the attack flow
MotivationESPIONAGE
Target sectorsgovernment administration, defense, transport, critical-infrastructure, forestry, telecoms, energy
Target regionstajikistan, uzbekistan, turkmenistan, kyrgyzstan, 143 - Central Asia, pakistan
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5756 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Silent Lynx Hidden PowerShell LNK Stager with AMSI Bypass and Operator Payload Fetch (P.ps1)

Detects the Silent Lynx (UAT-6275 / TAG-193) spear-phishing execution chain: a PDF-icon LNK launched from Explorer/archiver spawns hidden PowerShell that downloads a decoy PDF and the P.ps1 reverse shell from the operator server 89.125.213.123:8080, runs it in memory and opens a raw TCP shell to port 46125. Also fires on the newer variant that disables AMSI via reflection (amsiInitFailed) before download. Behaviour-first: a hidden-window PowerShell with a download cradle launched by a user-facing parent is alerting-worthy even without the IOC strings.

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*powershell.exe" OR Image="*pwsh.exe") (ParentImage="*explorer.exe" OR ParentImage="*cmd.exe" OR ParentImage="*wscript.exe" OR ParentImage="*winrar.exe" OR ParentImage="*7zFM.exe")
| eval ci=lower(CommandLine)
| eval hidden=if(match(ci,"-w[a-z]*[ ]+h"),1,0), cradle=if(match(ci,"downloadstring|invoke-webrequest|iwr[ ]|iex[ ]|invoke-expression|webclient"),1,0), amsi=if(like(ci,"%amsiinitfailed%"),1,0), ioc=if(match(ci,"89[.]125[.]213[.]123|p[.]ps1|decoy[.]pdf|foreverpeace[.]ru"),1,0)
| where (hidden=1 AND cradle=1) OR amsi=1 OR ioc=1
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parents values(CommandLine) as command_lines by host User Image
| table first_seen last_seen host User Image parents command_lines count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe', 'pwsh.exe')
| where InitiatingProcessFileName in~ ('explorer.exe', 'cmd.exe', 'wscript.exe', 'winrar.exe', '7zFM.exe')
| extend ci = tolower(ProcessCommandLine)
| extend Hidden = ci matches regex @'-w[a-z]*\s+h',
         Cradle = ci has_any ('downloadstring', 'invoke-webrequest', 'iwr', 'iex', 'invoke-expression', 'webclient'),
         Amsi = ci has 'amsiinitfailed',
         IocHit = ci has_any ('89.125.213.123', 'p.ps1', 'decoy.pdf', 'foreverpeace.ru')
| where (Hidden and Cradle) or Amsi or IocHit
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Hidden, Cradle, Amsi, IocHit

Sigma

title: Silent Lynx Hidden PowerShell LNK Stager with AMSI Bypass
id: 3b1f7a52-8c4e-4d19-a6f3-0e5d2c9b7a11
status: experimental
description: Detects hidden-window PowerShell launched from Explorer/archivers with a download cradle, the amsiInitFailed reflection AMSI bypass, or Silent Lynx operator infrastructure (89.125.213.123, P.ps1).
references:
    - https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
    - https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1562.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\winrar.exe'
            - '\7zFM.exe'
    selection_hidden:
        CommandLine|contains:
            - '-WindowStyle Hidden'
            - '-w hidden'
            - '-win hidden'
    selection_cradle:
        CommandLine|contains:
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'iex '
            - 'Invoke-Expression'
            - 'Net.WebClient'
    selection_amsi:
        CommandLine|contains: 'amsiInitFailed'
    selection_ioc:
        CommandLine|contains:
            - '89.125.213.123'
            - '/P.ps1'
            - '/decoy.pdf'
            - 'foreverpeace.ru'
    condition: selection_img and selection_parent and ((selection_hidden and selection_cradle) or selection_amsi or selection_ioc)
falsepositives:
    - Administrative logon scripts launched via cmd.exe that use hidden PowerShell with web downloads
    - Software deployment wrappers
level: high

Known false positives:

  • Administrative or logon scripts that run hidden PowerShell with Invoke-WebRequest from cmd.exe
  • Software deployment or patching wrappers that fetch content over HTTP from an internal server

Tuning notes: Exclude known deployment tooling by ParentImage/User and internal download hosts. Keep the amsiInitFailed and operator-IOC branches unconditional. Enable PowerShell Script Block Logging (4104) as a companion source.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Silent Lynx GeoServer Exploitation: PostgreSQL COPY FROM PROGRAM / Java Spawned Shell (Smart Forestry) · unlock with TL Creds
  • Silent Lynx Domain Credential Theft: NTDS Dumping and Responder/Inveigh/NetExec/Impacket Tooling · unlock with TL Creds
  • Silent Lynx Tunneling, Pivoting and Internal Scanning (Ligolo-mp, GOST, fscan, NetBird) · unlock with TL Creds
  • Archive Extraction Drops Startup Persistence or PDF-Icon LNK Lure (Silent Lynx / WinRAR CVE-2025-8088) · unlock with TL Creds
  • Silent Lynx Linux Cron Callback Persistence and Shell History / Login Record Wiping · unlock with TL Creds
  • Silent Lynx Operator Infrastructure and AI-Agent Control Channels ([indicator], Telegram Bot API, OpenRouter) · unlock with TL Creds
  • Silent Lynx Lookalike Windows Service Install (netsrvc / CoreMessaging / ssdpdrv / ssdspsrv / srvdriv) · unlock with TL Creds
  • Silent Lynx C2 and Payload Infrastructure Connections ([indicator], [indicator], port 46125, [indicator]) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5756.

Sample indicators (3 of 23)

  • IP address: 89.125.213[.]123
  • Domain: foreverpeace[.]ru
  • File hash: af2822560bc0e44b600eefbe0170d3526e035704b533a806f9d455da6ac30d2c

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

23 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

CloudSEK (published 2026-11-11) analysed an open directory exposed on the operator server 89.125.213.123 (port 8088). Implant markers and build paths match published Silent Lynx samples (high confidence on the server and tooling; medium-high on the intrusion set). The directory contained the Laplas TLS reverse shell (srvdriv.exe, VS project 'Laplasgeneral'), the Chvost shell (ssdpdrv.exe, PDB path \chvost\Release\Netdrv.pdb), a PowerShell reverse shell (P.ps1), Windows service wrappers with lookalike names (netsrvc.exe, CoreMessaging.exe, ssdspsrv.exe), LNK lure variants, and open-source tooling (fscan, Ligolo-mp, GOST, Inveigh, Responder, NetExec, Impacket, Metasploit).

Delivery uses spear-phishing LNK files (PDF icon) inside ZIP (plain or password-protected) or ISO containers. The shortcut launches hidden PowerShell that fetches a decoy PDF and P.ps1 from the operator server, runs it in memory, and opens a raw TCP shell to port 46125. A newer variant performs an AMSI bypass via reflection (amsiInitFailed) before download; CloudSEK states this was not documented in earlier public reporting. Earlier chains (Peek-a-Baku, Talos Chain C) hosted scripts on GitHub, whereas this kit serves them from the operator server.

Confirmed victims: Tajikistan's national railway (domain-level access from mid-August 2026 to at least 2026-10-10, with an earlier host-level presence in April-May 2026, including NTDS dumps with Administrator and krbtgt, SMBv1 enabled / SMB signing disabled, and default-password network devices); Tajikistan's national EDO government document platform (2,000+ unique documents including Ministry of Defence correspondence, accessed via a single compromised railway employee account through government SSO, abusing weak per-document authorisation and an unauthenticated file service); and Uzbekistan's Smart Forestry GeoServer host (malicious WAR deployment, a webshell on /health/, PostgreSQL superuser login and COPY ... FROM PROGRAM for a reverse shell, cron callbacks to the operator and 134.17.14.24, persistence in place at exposure). A Pakistan MFA/telecom engagement and Armenian filtering are noted in agent memory but are not confirmed compromises. A Turkmenistan Railways e-ticket lure and an Ahal regional administration lure were built and tested but not yet deployed per the article.

The operator ran a Hermes agent framework instance (persona 'Strix') controlled over Telegram, using DeepSeek V4.1 Flash with a Gemini 2.5 Flash sub-agent via OpenRouter, with destructive commands allowed without confirmation. The agent ran recon dispatch, collectors with resume logic, and anti-forensic cleanup (deleted messages, vacuumed databases, shredded shell histories, zeroed login records) but missed the exposed directory. Infrastructure used NetBird and Pangolin on foreverpeace.ru. Attribution: Kazakhstan nexus at medium confidence (Russian-language operation, Kazakhtelecom test traffic, UTC+5 working hours based on only three working days of data), consistent with Cisco Talos (UAT-6275) and Recorded Future (TAG-193). Motivation assessed as regional intelligence gathering. Talos separately reports the cluster exploiting WinRAR CVE-2025-8088 in an April 2026 chain (not observed on this server).

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.003 NTDS; T1557.001 Name Resolution Poisoning and SMB Relay

Defense Evasion

T1036.004 Masquerade Task or Service; T1070.003 Clear Command History

Collection

T1039 Data from Network Shared Drive

Discovery

T1046 Network Service Discovery

Persistence

T1053.003 Cron; T1505.003 Web Shell; T1543.003 Windows Service

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment

Command and Control

T1090.003 Multi-hop Proxy; T1102.002 Bidirectional Communication; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

  • Update WinRAR to 7.13 or later (CVE-2025-8088) per vendor advisory
  • Apply MS17-010 on all Windows hosts

Immediate actions

  • Block 89.125.213.123 (ports 46125, 8080, 8088) and 134.17.14.24 at the perimeter and hunt for historical connections
  • Block or sinkhole foreverpeace.ru
  • Hunt for services named netsrvc, CoreMessaging, ssdpdrv, ssdspsrv/srvdriv and the listed SHA-256 hashes
  • Review GeoServer hosts for unexpected WAR deployments, /health/ webshells and PostgreSQL COPY ... FROM PROGRAM use; audit cron entries
  • Reset krbtgt and privileged credentials on domains with suspected NTDS exposure; rotate default credentials on MikroTik, Cisco and D-Link devices

Workarounds

  • Restrict creation of Windows services by non-administrative tooling and alert on service installs from user-writable paths
  • Egress-filter raw TCP to non-standard ports such as 46125

Longer-term hardening

  • Disable SMBv1 and enforce SMB signing; patch legacy Windows Server 2008 R2 hosts
  • Block LNK files inside ZIP/ISO email attachments and mark-of-the-web propagation for ISO containers
  • Enable PowerShell Script Block and AMSI telemetry; alert on amsiInitFailed reflection
  • Enforce per-document authorisation and authentication on government document platforms and SSO-linked services
  • Restrict outbound traffic from servers and monitor Telegram API / OpenRouter access from server segments

Affected and fixed versions

  • Tajikistan State Railway — Railway corporate network (Active Directory domain)
    Vulnerable versions: Domain compromised mid-Aug to at least 2026-10-10
  • Tajikistan Government — EDO national document exchange platform
    Vulnerable versions: Weak per-document authorisation; unauthenticated file service
  • Uzbekistan Smart Forestry — GeoServer with PostgreSQL backend
    Vulnerable versions: Host command execution and webshell persistence observed
  • Microsoft — Windows Server 2008 R2 (MS17-010 targeted)
    Vulnerable versions: Unpatched SMBv1 hosts
    Fixed in: Systems with MS17-010 applied
  • RARLAB — WinRAR (CVE-2025-8088, per Talos for the cluster)
    Vulnerable versions: 7.12 and earlier
    Fixed in: 7.13

Timeline

  • Seqrite first publicly documents Silent Lynx targeting Kyrgyzstan and neighbouring nations (Telegram C2).
  • Group-IB publishes ShadowSilk; an August 2025 Turkmennebit-themed decoy is documented.
  • Seqrite publishes Operation Peek-a-Baku describing a shift to Dushanbe-themed lures with GitHub-hosted scripts.
  • Tajikistan Laplas srvdriv.exe build compiled; Ligolo tunnel via host 'DC' active April to May 2026. Talos Chain D separately uses WinRAR CVE-2025-8088 in April 2026.
  • Activity against Uzbekistan's Smart Forestry initiative observed (per prior Talos reporting cited by CloudSEK).
  • Operator's Telegram session with the Hermes agent begins (mid-August) and the Tajikistan railway domain intrusion starts.
  • Railway-specific Laplas build and CoreMessaging.exe wrapper compiled (late August); a second pair follows in early September.
  • Late September to early October: five days of root SSH logins (hundreds of logins from 100+ source IPs) logged by the agent.
  • Operator tests a shell from Kazakhtelecom then Proton VPN four minutes apart; early October ISO bundle built and agent-run cleanup performed.
  • Last confirmed access to the Tajikistan railway network.
  • Cisco Talos publishes UAT-6275 report (WinRAR CVE-2025-8088 chain); Recorded Future TAG-193 report published in October.
  • CloudSEK publishes analysis of the exposed Silent Lynx server, including the AI-agent-driven operations and the Turkmenistan-themed lures built but not yet deployed.

Sources cited

More from YoroTrooper

Other reports on CVE-2025-8088

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats