Kazakh-linked hackers target Russian refinery and Central Asian governments

Silent Lynx, also known as UAT‑6275 or TAG‑193, is believed to be based in Kazakhstan. Researchers from Cisco Talos and Recorded Future say the group has targeted high‑value public‑sector organisations across the Commonwealth of Independent States since at least 2024. They use spear‑phishing emails from compromised government mailboxes and stage malware on sites such as GitHub, Telegram, and hijacked servers. Their lightweight toolkit includes PowerShell reverse shells, custom C++ and Go back‑doors, and commodity tunnelling tools.

Targeted Infrastructure and Tactics

In April 2026 Silent Lynx exploited a WinRAR path‑traversal flaw (CVE‑2025‑8088) to drop malware into the Windows Startup folder of Armenia’s Ministry of Foreign Affairs, a first for the actor. The same month the group also targeted Russia’s Orsk oil refinery, a facility shut after a Ukrainian drone strike in August 2025 and key to energy‑security talks between Russia and Kazakhstan. Earlier campaigns hit a Tajik government entity after treaty talks with Kazakhstan in March 2026 and a Belarusian agency before a bilateral meeting in April.

The group’s focus on ministries of foreign affairs, economic development, agriculture, environment and water resources shows the strategic value of the data it seeks, as shared river systems and energy infrastructure bind the former Soviet states. Researchers expect Silent Lynx to continue expanding its arsenal beyond phishing, having already begun exploiting software vulnerabilities and testing malware in Kazakhstan. Its low‑profile tools have kept it largely unnoticed until now, but the recent attacks raise concerns about the security of critical infrastructure across Central Asia.