Researchers report that the threat actor Silent Lynx ran multiple real-world spear‑phishing campaigns against government organizations across Central Asia and the wider CIS region. Victims were lured with official-looking documents (e.g., diplomatic letters, airspace applications, and oil refinery business proposals) that led to malware delivery and remote access via custom reverse shells.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: “Subject: Diplomatic letter addressed to Armenia’s Ministry of Foreign Affairs” lands in your inbox, looks 100% official. Silent Lynx, tracked as UAT-6275 and TAG-193, sends these from compromised government accounts, diplomatic letters, Turkmenistan airspace forms, even oil refinery proposals, each attachment wired to macros, PowerShell, GitHub scripts, or booby-trapped RAR files. Open it, and you’re not just reading a letter, you’re handing them remote access via custom shells like FoalShell, Chvost, Laplas, or PickleShell. The trick? They abuse your trust in that familiar government sender and the ‘this looks like normal paperwork’ feeling. If you get an unexpected diplomatic, airspace, trade, or energy document, even from a real government address, stop. Don’t open it. Report it to security and forward the email so they can isolate it.
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Microsoft reports real-world Star Blizzard phishing campaigns where victims who engage with an initial email receive a follow-up message containing a password-protected ZIP/RAR attachment. The attachment chain hides a malicious shortcut disguised as a PDF, opening a decoy file while quietly…
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
Researchers say the Kazakhstan-linked group “Silent Lynx” has run real espionage campaigns across Central Asia, targeting government bodies and energy organizations. The reported entry method relied heavily on spear‑phishing sent from compromised government email accounts, sometimes using trusted…
