Skip to content

Image: securityaffairs.com · rights & removal

Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government

Reporting by Security Affairs (Pierluigi Paganini)Read the original at securityaffairs.com

Objectivity score: 63 out of 100.
Difficulty 72 out of 100 (Expert)— Read Analysis

Executive Summary

A persistent threat actor, designated Silent Lynx (also tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future), operates from a Kazakhstan nexus and conducts espionage campaigns against high-value public sector targets across Central Asia. These operations have been observed since at least 2024, focusing on government bodies, diplomatic missions, and civil society organizations within the Commonwealth of Independent States (CIS). The actor leverages spear-phishing delivered via compromised government email accounts and employs staging platforms like GitHub and Telegram to maintain credibility.
The operational scope spans regional interests; targets include governmental entities in Nizhny Novgorod and critical energy infrastructure, such as the Orsk Oil Refinery near the Kazakhstan border. Technical indicators suggest a deliberate focus on low technical visibility—using lightweight tools like PowerShell reverse shells—while operational sloppiness revealed origin details, including keyboard layouts and specific time zone alignment for activity logs. The group is noted to be evolving its tactics, moving from purely social engineering approaches to exploiting software vulnerabilities, such as a WinRAR path traversal flaw in April 2026.

Facts Only

Actors include Silent Lynx (UAT-6275, TAG-193).
The group targets government bodies, diplomatic missions, and civil society organizations across Central Asia.
Targeted institutions mentioned are the Orsk Oil Refinery in southern Russia and the government of Nizhny Novgorod.
Operations against Central Asian entities have occurred since at least 2024.
Staging platforms utilized include GitHub, Telegram, and hijacked legitimate servers.
Evidence links operational activity to March 2026 (Tajik agency contacting Silent Lynx server) and April 2026 (Belarusian entity appearing on same infrastructure).
Malware exhibited typing characteristics suggesting a Russian keyboard layout activated with Latin input (e.g., “црщфьш” for “whoami”).
Activity timestamps fit Astana, Kazakhstan working hours at 95% accuracy compared to Moscow time.
Administration connections were traced from ProtonVPN egress IPs geolocated to Kazakhstan during weekday morning hours.
The actor first used an exploit in April 2026, abusing the WinRAR path traversal flaw (CVE-2025-8088).

Full Take

This intelligence package describes a calculated evolution: a long-term, regionally focused espionage capability that transitions from relying solely on

From the original · Security Affairs (Pierluigi Paganini)

Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia.
Read the full story at securityaffairs.com

Sentinel — Human

Confidence

The text exhibits strong indicators of primary journalistic aggregation, blending technical forensic findings with contextual geopolitical analysis. The narrative flow is complex and demonstrates authorial engagement beyond mere template repetition.

Signals Detected
low severity: Strong narrative progression from technical detail to geopolitical implication.
low severity: Presence of detailed, non-uniform digressions (e.g., the specific context around the Orsk refinery drone attack).
low severity: Direct citation and integration of specific external reports/figures ('Figure 11', 'BREAK THE SILENCE' report).
low severity: Presence of verifiable, named entities (Cisco Talos, Recorded Future) framing the claims.
Human Indicators
The inclusion of operational sloppiness ('whoami' output in Russian layout) acts as a specific human-driven analytical hook.
The nuanced statement, 'These links do not prove the reasons behind the activity, but the researchers highlight them...', demonstrates controlled intellectual hedging characteristic of careful reporting.
Specific temporal details tied to geopolitical events (e.g., Tajik treaty ratification relative to server contact) suggest deep context integration.
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government | Huntaegis