Silent Lynx Lures CIS Officials With Fake Diplomacy Docs

Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to install remote-access tools, and also included at least one credential-harvesting site impersonating a government service.

Key findings

• UAT-6275/TAG-193 targeted government organizations across the CIS; artifacts also indicate interest in water resources and energy.
• Decoy documents were used to socially engineer victims, including diplomatic and energy-themed content.
• Multiple delivery methods were observed: macro-enabled Word documents, PS2EXE-based downloaders, shortcut-launched PowerShell fetching payloads from GitHub, and a crafted WinRAR archive exploiting CVE-2025-8088.
• The campaign included 'a credential-harvesting site impersonating Azerbaijan’s State Agency for Public Service.'
• Exposed staging directories and GitHub history provided visibility into malware builds, tooling, and C2 changes.

Who’s being targeted

• Commonly targeted roles: Government leadership, Diplomatic affairs / foreign ministry staff, Energy and environmental agency staff, Executive assistants, IT and security operations.
• Affected industries: Government, Diplomatic affairs / foreign ministries, Environmental management / water resources, Energy / oil and gas.
• Attack channels: email, website.
• Impersonated: Russian diplomatic sender / diplomatic mission, Turkmennebit (state oil company) or Orsk Oil Refinery management, Azerbaijan’s State Agency for Public Service.

Awareness takeaways

• Treat unexpected “official” diplomatic or government documents as high risk, verify via known, separate channels before opening attachments.
• Be cautious with proposal-themed attachments (especially archives): attackers may use realistic energy/resource topics to get recipients to open malicious files.
• Don’t enter credentials into lookalike government portals; verify the exact URL and use bookmarks or known official links.
• For IT teams: watch for unusual PowerShell activity and downloads from public code-hosting sites; these can be signs of malware delivery.

Red flags to watch for

• Unexpected diplomatic document arriving by email
• Attachment requires enabling macros/active content
• Sender identity is difficult to verify independently
• Unsolicited 'proposal' sent as an attachment
• Pressure to review an attachment instead of using official channels
• Attachment format could be unusual for business proposals (e.g., archive file)
• Login page URL/domain does not match the official government domain
• Unexpected login request not initiated by the user
• Page design/content looks slightly off or incomplete