Researchers say the Kazakhstan-linked group “Silent Lynx” has run real espionage campaigns across Central Asia, targeting government bodies and energy organizations. The reported entry method relied heavily on spear‑phishing sent from compromised government email accounts, sometimes using trusted services like GitHub to make malware delivery look legitimate. One cited lure was a document framed as a business cooperation proposal involving the Orsk Oil Refinery.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you get an email from a real government address about an energy deal with the Orsk Oil Refinery. This is how the group Silent Lynx works: they hijack real government mailboxes, send a spear‑phishing email, and attach a “Business proposal on cooperation… between ‘Turkmennebit’ and the management of Orsk Refinery” that secretly drops malware. Sometimes they don’t attach it at all. The same compromised gov account sends you a link to GitHub, saying, “Download the documents here.” GitHub is legit, but Silent Lynx uses it to stage malware and look safe. If you get an unexpected “business proposal” or download link about energy or government work, even from a real gov address, stop. Don’t open it. Forward it to security and ask them to verify first.
Researchers tracked Kazakhstan-nexus group UAT-6275 (TAG-193) targeting government organizations across Central Asia and the wider CIS using convincing decoy documents tied to diplomacy and energy. The campaigns used malicious files (macro-enabled Word docs, shortcuts, and a WinRAR exploit) to…
Researchers report that the threat actor Silent Lynx ran multiple real-world spear‑phishing campaigns against government organizations across Central Asia and the wider CIS region. Victims were lured with official-looking documents (e.g., diplomatic letters, airspace applications, and oil refinery…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
Researchers observed a real phishing campaign that abused Microsoft 365’s “Direct Send” feature to deliver messages that looked like they came from trusted internal addresses (HR, accounting, admin). The emails commonly used familiar business lures like invoices, payment approvals, voicemail…
