Silent Lynx hackers suspected of targeting Central Asian governments

Researchers from Cisco Talos and Recorded Future have identified a cyber-espionage group, tracked as Silent Lynx (also known as UAT-6275 and TAG-193), with suspected ties to Kazakhstan. The group has conducted at least eight targeted intrusion campaigns since early 2025, focusing on government agencies, diplomatic missions, and civil society organizations across Central Asia and former Soviet states.

Targets include Russia, Belarus, Armenia, Uzbekistan, and Tajikistan. Specific interests involve agencies managing foreign affairs, economic development, agriculture, and environmental resources. The group has targeted high-value infrastructure, such as the Orsk Oil Refinery in southern Russia and the government of Nizhny Novgorod.

Analysts noted the strategic value of the information sought, particularly regarding shared river systems, regional energy supplies, and interconnected transport infrastructure. The hackers utilize lightweight toolkits, including PowerShell-based reverse shells and spear-phishing campaigns conducted through compromised government email accounts. Evidence linking the group to Kazakhstan includes Russian-language malware, software testing originating from the country, and activity aligning with Kazakhstani time zones.