# Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures

> CloudSEK analysed an exposed open directory belonging to a Silent Lynx operator, a Central Asia-focused espionage cluster. It held Laplas/Chvost implants, data from intrusions into Tajik and Uzbek government and critical infrastructure, and logs of an AI agent (Hermes, persona 'Strix') the operator used to run operations through October 2026.

- **Published:** 2026-11-11T11:35:12Z
- **Last reviewed:** 2026-11-11T11:35:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5756
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5756.png
- **ID:** TL-2026-5756
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** YoroTrooper (Kazakhstan)
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (3 shown free below)
- **CVEs:** CVE-2025-8088

## Description

CloudSEK (published 2026-11-11) analysed an open directory exposed on the operator server 89.125.213.123 (port 8088). Implant markers and build paths match published Silent Lynx samples (high confidence on the server and tooling; medium-high on the intrusion set). The directory contained the Laplas TLS reverse shell (srvdriv.exe, VS project 'Laplasgeneral'), the Chvost shell (ssdpdrv.exe, PDB path \chvost\Release\Netdrv.pdb), a PowerShell reverse shell (P.ps1), Windows service wrappers with lookalike names (netsrvc.exe, CoreMessaging.exe, ssdspsrv.exe), LNK lure variants, and open-source tooling (fscan, Ligolo-mp, GOST, Inveigh, Responder, NetExec, Impacket, Metasploit).

Delivery uses spear-phishing LNK files (PDF icon) inside ZIP (plain or password-protected) or ISO containers. The shortcut launches hidden PowerShell that fetches a decoy PDF and P.ps1 from the operator server, runs it in memory, and opens a raw TCP shell to port 46125. A newer variant performs an AMSI bypass via reflection (amsiInitFailed) before download; CloudSEK states this was not documented in earlier public reporting. Earlier chains (Peek-a-Baku, Talos Chain C) hosted scripts on GitHub, whereas this kit serves them from the operator server.

Confirmed victims: Tajikistan's national railway (domain-level access from mid-August 2026 to at least 2026-10-10, with an earlier host-level presence in April-May 2026, including NTDS dumps with Administrator and krbtgt, SMBv1 enabled / SMB signing disabled, and default-password network devices); Tajikistan's national EDO government document platform (2,000+ unique documents including Ministry of Defence correspondence, accessed via a single compromised railway employee account through government SSO, abusing weak per-document authorisation and an unauthenticated file service); and Uzbekistan's Smart Forestry GeoServer host (malicious WAR deployment, a webshell on /health/, PostgreSQL superuser login and COPY ... FROM PROGRAM for a reverse shell, cron callbacks to the operator and 134.17.14.24, persistence in place at exposure). A Pakistan MFA/telecom engagement and Armenian filtering are noted in agent memory but are not confirmed compromises. A Turkmenistan Railways e-ticket lure and an Ahal regional administration lure were built and tested but not yet deployed per the article.

The operator ran a Hermes agent framework instance (persona 'Strix') controlled over Telegram, using DeepSeek V4.1 Flash with a Gemini 2.5 Flash sub-agent via OpenRouter, with destructive commands allowed without confirmation. The agent ran recon dispatch, collectors with resume logic, and anti-forensic cleanup (deleted messages, vacuumed databases, shredded shell histories, zeroed login records) but missed the exposed directory. Infrastructure used NetBird and Pangolin on foreverpeace.ru. Attribution: Kazakhstan nexus at medium confidence (Russian-language operation, Kazakhtelecom test traffic, UTC+5 working hours based on only three working days of data), consistent with Cisco Talos (UAT-6275) and Recorded Future (TAG-193). Motivation assessed as regional intelligence gathering. Talos separately reports the cluster exploiting WinRAR CVE-2025-8088 in an April 2026 chain (not observed on this server).

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1543.003 Windows Service
- T1505.003 Web Shell
- T1053.003 Cron
- T1685 Disable or Modify Tools
- T1036.004 Masquerade Task or Service
- T1070.003 Clear Command History
- T1003.003 NTDS
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1046 Network Service Discovery
- T1039 Data from Network Shared Drive
- T1572 Protocol Tunneling
- T1573.002 Asymmetric Cryptography
- T1102.002 Bidirectional Communication
- T1090.003 Multi-hop Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Silent Lynx Hidden PowerShell LNK Stager with AMSI Bypass and Operator Payload Fetch (P.ps1)** (`TL-2026-5756-SPL-001`)

Detects the Silent Lynx (UAT-6275 / TAG-193) spear-phishing execution chain: a PDF-icon LNK launched from Explorer/archiver spawns hidden PowerShell that downloads a decoy PDF and the P.ps1 reverse shell from the operator server 89.125.213.123:8080, runs it in memory and opens a raw TCP shell to port 46125. Also fires on the newer variant that disables AMSI via reflection (amsiInitFailed) before download. Behaviour-first: a hidden-window PowerShell with a download cradle launched by a user-facing parent is alerting-worthy even without the IOC strings.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059.001, T1562.001, T1105
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*powershell.exe" OR Image="*pwsh.exe") (ParentImage="*explorer.exe" OR ParentImage="*cmd.exe" OR ParentImage="*wscript.exe" OR ParentImage="*winrar.exe" OR ParentImage="*7zFM.exe")
| eval ci=lower(CommandLine)
| eval hidden=if(match(ci,"-w[a-z]*[ ]+h"),1,0), cradle=if(match(ci,"downloadstring|invoke-webrequest|iwr[ ]|iex[ ]|invoke-expression|webclient"),1,0), amsi=if(like(ci,"%amsiinitfailed%"),1,0), ioc=if(match(ci,"89[.]125[.]213[.]123|p[.]ps1|decoy[.]pdf|foreverpeace[.]ru"),1,0)
| where (hidden=1 AND cradle=1) OR amsi=1 OR ioc=1
| stats count min(_time) as first_seen max(_time) as last_seen values(ParentImage) as parents values(CommandLine) as command_lines by host User Image
| table first_seen last_seen host User Image parents command_lines count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe', 'pwsh.exe')
| where InitiatingProcessFileName in~ ('explorer.exe', 'cmd.exe', 'wscript.exe', 'winrar.exe', '7zFM.exe')
| extend ci = tolower(ProcessCommandLine)
| extend Hidden = ci matches regex @'-w[a-z]*\s+h',
         Cradle = ci has_any ('downloadstring', 'invoke-webrequest', 'iwr', 'iex', 'invoke-expression', 'webclient'),
         Amsi = ci has 'amsiinitfailed',
         IocHit = ci has_any ('89.125.213.123', 'p.ps1', 'decoy.pdf', 'foreverpeace.ru')
| where (Hidden and Cradle) or Amsi or IocHit
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Hidden, Cradle, Amsi, IocHit
```

### Sigma

```yaml
title: Silent Lynx Hidden PowerShell LNK Stager with AMSI Bypass
id: 3b1f7a52-8c4e-4d19-a6f3-0e5d2c9b7a11
status: experimental
description: Detects hidden-window PowerShell launched from Explorer/archivers with a download cradle, the amsiInitFailed reflection AMSI bypass, or Silent Lynx operator infrastructure (89.125.213.123, P.ps1).
references:
    - https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
    - https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1562.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\winrar.exe'
            - '\7zFM.exe'
    selection_hidden:
        CommandLine|contains:
            - '-WindowStyle Hidden'
            - '-w hidden'
            - '-win hidden'
    selection_cradle:
        CommandLine|contains:
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'iex '
            - 'Invoke-Expression'
            - 'Net.WebClient'
    selection_amsi:
        CommandLine|contains: 'amsiInitFailed'
    selection_ioc:
        CommandLine|contains:
            - '89.125.213.123'
            - '/P.ps1'
            - '/decoy.pdf'
            - 'foreverpeace.ru'
    condition: selection_img and selection_parent and ((selection_hidden and selection_cradle) or selection_amsi or selection_ioc)
falsepositives:
    - Administrative logon scripts launched via cmd.exe that use hidden PowerShell with web downloads
    - Software deployment wrappers
level: high
```

**Known false positives:**

- Administrative or logon scripts that run hidden PowerShell with Invoke-WebRequest from cmd.exe
- Software deployment or patching wrappers that fetch content over HTTP from an internal server

**Tuning notes:** Exclude known deployment tooling by ParentImage/User and internal download hosts. Keep the amsiInitFailed and operator-IOC branches unconditional. Enable PowerShell Script Block Logging (4104) as a companion source.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Silent Lynx GeoServer Exploitation: PostgreSQL COPY FROM PROGRAM / Java Spawned Shell (Smart Forestry) (locked: unlock with TL Creds)
- Silent Lynx Domain Credential Theft: NTDS Dumping and Responder/Inveigh/NetExec/Impacket Tooling (locked: unlock with TL Creds)
- Silent Lynx Tunneling, Pivoting and Internal Scanning (Ligolo-mp, GOST, fscan, NetBird) (locked: unlock with TL Creds)
- Archive Extraction Drops Startup Persistence or PDF-Icon LNK Lure (Silent Lynx / WinRAR CVE-2025-8088) (locked: unlock with TL Creds)
- Silent Lynx Linux Cron Callback Persistence and Shell History / Login Record Wiping (locked: unlock with TL Creds)
- Silent Lynx Operator Infrastructure and AI-Agent Control Channels ([indicator], Telegram Bot API, OpenRouter) (locked: unlock with TL Creds)
- Silent Lynx Lookalike Windows Service Install (netsrvc / CoreMessaging / ssdpdrv / ssdspsrv / srvdriv) (locked: unlock with TL Creds)
- Silent Lynx C2 and Payload Infrastructure Connections ([indicator], [indicator], port 46125, [indicator]) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 23)

Defanged, TLP:CLEAR.

- IP address: `89.125.213[.]123`
- Domain: `foreverpeace[.]ru`
- File hash: `af2822560bc0e44b600eefbe0170d3526e035704b533a806f9d455da6ac30d2c`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Off the Rails: Inside an Exposed Silent Lynx Server (CloudSEK)](https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server)
- [Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations (Cisco Talos)](https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/)
- [Silent Lynx exploits WinRAR flaw (The Hacker News)](https://thehackernews.com/2026/10/silent-lynx-exploits-winrar-flaw-to.html)
- [TAG-193 regional espionage operations (Recorded Future Insikt Group)](http://www.recordedfuture.com/blog/tag193-regional-espionage-operations)
- [Break the silence: tracking Silent Lynx through exposed infrastructure (Virus Bulletin 2026)](https://www.virusbulletin.com/uploads/pdf/conference/vb2026/papers/Break-the-silence-tracking-Silent-Lynx-through-exposed-infrastructure.pdf)
- [Operation Peek-a-Baku: Silent Lynx APT makes sluggish shift to Dushanbe (Seqrite)](https://www.seqrite.com/blog/operation-peek-a-baku-silent-lynx-apt-dushanbe-espionage/)
- [Unveiling Silent Lynx APT targeting entities across Kyrgyzstan and neighbouring nations (Seqrite)](https://seqrite.com/blog/silent-lynx-apt-targeting-central-asian-entities/)
- [ShadowSilk (Group-IB)](https://www.group-ib.com/blog/shadowsilk/)
- [Hydra Saiga: covert espionage and infiltration of critical utilities (VMRay)](https://www.vmray.com/hydra-saiga-covert-espionage-and-infiltration-of-critical-utilities/)
- [Attributing YoroTrooper (Cisco Talos)](https://blog.talosintelligence.com/attributing-yorotrooper/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5756