Silent Lynx: uncovering a cyber espionage campaign in Central Asia

Silent Lynx: Uncovering a Cyber Espionage Campaign in Central Asia

Speakers: Subhajeet Singha (Threat Researcher, Seqrite Labs); Sathwik Ram Prakki (Senior Security Researcher, Seqrite Labs)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=EvHq2YPxxaY

Overview

In a revealing presentation at Virus Bulletin, Seqrite Labs researchers Sathwik Ram Prakki and Subhajeet Singha unveiled "Silent Lynx," a persistent and evolving cyber espionage campaign primarily targeting government officials and critical entities across more than 10 Central Asian countries. This comprehensive analysis sheds light on a threat group that leverages a blend of free, commodity, and custom Remote Access Trojans (RATs) and innovative command-and-control (C2) mechanisms, notably Telegram bots. The talk detailed the group's tactical evolution, infection chains, and infrastructure, underscoring its significant threat to regional stability and national security.

The Silent Lynx campaign, discovered by Seqrite Labs in December 2024 and observed to be active through early 2025, represents a sophisticated yet at times operationally sloppy adversary. Its targets include national banks, ministries of finance, railway entities, and embassies in nations such as Kyrgyzstan, Uzbekistan, Tajikistan, and Turkmenistan, with an observed expansion to Pakistan and Myanmar. The researchers’ deep dive into Silent Lynx's activities not only maps out its current modus operandi but also establishes strong links to the previously documented EuroTrooper Advanced Persistent Threat (APT) group, highlighting a continuous and adaptive threat landscape in the region.

The significance of this research lies in its detailed exposure of an APT group that, despite using readily available tools, consistently achieves its espionage objectives. By tracking the group's evolution since 2021, Seqrite Labs provides critical insights into its TTPs (Tactics, Techniques, and Procedures), allowing defenders to better anticipate and mitigate future attacks. The use of compromised government email accounts for spear-phishing, coupled with diverse payload delivery methods and C2 infrastructure, paints a picture of a pragmatic and persistent adversary focused on data theft and supporting state objectives.

Background

▶ Watch: Introduction to Silent Lynx cyber espionage group (0:00)

The evolution of the threat group now identified as Silent Lynx can be traced back through several years of documented activity by various security researchers, indicating a long-standing and adaptive presence in the cyber espionage landscape. The earliest reported activity linked to this group dates back to 2021, when SCAX reported on a campaign targeting entities in the EMA and APAC regions, primarily focusing on credential harvesting. This initial phase already highlighted a focus on Central Asian entities, with Belarus, Ukraine, and Uzbekistan being among the most targeted nations, alongside Russia.

In 2022, ESET further illuminated the group's activities, naming them Sturgeonian Fisher. This period saw a shift towards MFA-based phishing lures, often related to popular webmail services, and an expansion of their arsenal to include commodity RATs like WarZone RAT, a custom RAT dubbed Rusty RAT, and open-source tools such as Stink Stealer and generic reverse shells. Later in June 2022, Cisco Talos identified a related group, EuroTrooper, which targeted government and energy sectors in EU and CIS regions. EuroTrooper employed similar tools, including Stink Stealer and WarZone RAT, but diversified its initial access vectors to include LNK and VHDX files. Russia, Belarus, and Azerbaijan were key targets during this phase.

The group's TTPs continued to evolve into 2023. Attacks observed against hydro energy entities in Uzbekistan and Tajikistan shifted from LNK stages to remotely loaded HDA stages and incorporated custom Python stages and Meterpreter reverse shells. Cisco Talos subsequently linked EuroTrooper to Kazakhstan, noting the use of credential harvesting sites and infrastructure pivoted to Central Asian regions, particularly Azerbaijan, to target Tajikistan and Kyrgyzstan. By September 2023, a significant retooling was observed, with the group transitioning from Python to PowerShell for some operations and, critically, beginning to utilize the Telegram API for C2 communications. This period also saw the introduction of custom Golang and Rust-based reverse shells, setting the stage for the Silent Lynx campaigns identified by Seqrite Labs. This continuous adaptation, coupled with a consistent focus on Central Asian governmental and critical infrastructure, underscores why this problem persists and demands ongoing vigilance.

Key Findings

▶ Watch: Initial infection chain using ISO files and Telegram C2 (6:15)

Seqrite Labs' investigation into Silent Lynx revealed several critical findings that define this cyber espionage campaign:

• Emergence of Silent Lynx: The researchers formally identified a new campaign, Silent Lynx, which they began tracking in December 2024, with activity continuing into 2025. This group is strongly linked to the previously identified EuroTrooper APT, suggesting an evolution or re-branding of an existing threat actor.
• Targeting Scope Expansion: Silent Lynx primarily targets government officials, national banks, ministries of finance, railway entities, and embassies. Initial campaigns focused on Kyrgyzstan, Uzbekistan, and Tajikistan. Subsequent findings, including those from Group-IB, indicate an expansion to over 35 government victims across Uzbekistan, Turkmenistan, Pakistan, Kyrgyzstan, and Myanmar, broadening the geographical reach beyond initial observations.
• Evolving TTPs and Arsenal: The group employs sophisticated spear-phishing techniques, utilizing compromised government email accounts to distribute malicious attachments. Initial access vectors include RAR archives and ISO files, some password-protected with the password provided directly in the email. Payloads range from custom C++ loaders and Golang-based reverse shells to heavily obfuscated PowerShell scripts (Base64 encoded). The arsenal includes commodity RATs (WarZone RAT), custom malware (Rusty RAT), open-source stealers (Stink Stealer), and red-teaming tools like ReSocks.
• Telegram Bots as C2: A standout finding is the pervasive use of Telegram bots for command and control. The PowerShell scripts and custom malware embed Telegram API endpoints and bot tokens, allowing threat actors to issue commands, exfiltrate data, and manage victim machines remotely. These bots are often named after countries, such as "South Korea" for targets in Kyrgyzstan, indicating an attempt at misdirection.
• Infrastructure Leveraging Public Services and Blunders: Silent Lynx utilizes public services like Google Drive for hosting payloads and Pastebin for delivering PowerShell commands. Analysis of their C2 communications revealed further infrastructure hosted in Azerbaijan. Operational security blunders were noted, such as reusing the same implant binary across different campaigns (e.g., a Bank of Kyrgyzstan implant used against Uzbekistan railways), and hardcoding sensitive information directly into binaries.
• Attribution to Kazakhstan-Affiliated EuroTrooper: Strong forensic links, including shared TTPs (spear-phishing, LNK/PowerShell usage, data exfiltration), similar arsenal components (ReSocks, Telegram bots), and infrastructure patterns, allowed Seqrite Labs to confidently attribute Silent Lynx to the Kazakhstan-affiliated EuroTrooper group, which has been active since at least 2022.
• Identified Subgroups: Further research, corroborated by Group-IB, identified two distinct subgroups within the operators: Chinese-speaking and Russian-speaking individuals. These operators are believed to control the infrastructure and carry out espionage activities aligned with Kazakhstan's state objectives.
• Advanced Tooling and Exploitation: The group's toolkit continues to evolve, incorporating public exploits such as PrintNightmare and other penetration testing tools found on their attacker servers. They also acquire web panels from underground forums to manage compromised victim machines, indicating an ongoing investment in their capabilities.

Technical Deep Dive

▶ Watch: Technical analysis of PowerShell Telegram bot capabilities (12:30)

The technical sophistication of Silent Lynx, despite its reliance on some commodity tools, is evident in its multi-stage infection chains and adaptable C2 mechanisms. The typical infection vector begins with spear-phishing emails containing malicious attachments, often disguised as legitimate documents from compromised government entities.

One observed infection chain, designated as the "spec campaign," starts with a RAR archive attached to a phishing email. Inside this archive is an ISO file. When mounted, the ISO contains two key files: a benign decoy document (e.g., a PDF related to a United Nations conference) and a malicious executable (EXE). The EXE is designed to be directly triggered by the victim. Upon execution, the decoy document is displayed to the user in the foreground, maintaining the illusion of a legitimate file opening. Simultaneously, in the background, the EXE decodes and executes a heavily obfuscated, Base64-encoded PowerShell script. This script is crucial as it contains the Telegram bot token IDs and API endpoints, establishing the C2 communication channel with the threat actor.

A second distinct infection chain was observed in the "employee campaign." Here, the initial RAR archive is password-protected, with the password conveniently provided within the body of the phishing email itself. This technique aims to bypass email gateway protections that might scan unencrypted attachments. Inside this archive, similar to the first campaign, are an EXE and a PDF decoy. However, in this instance, the EXE is a Golang-based reverse shell. This Golang implant is a simpler, more direct connection to the C2 server, with its functionalities and C2 details hardcoded and encoded directly within the binary. The researchers noted this particular Golang implant appeared to be "hasty work," suggesting rapid deployment.

Detailed analysis of the C++ loader used in the first campaign revealed that its primary function is to embed an encoded PowerShell blob. It uses the standard Windows API function CreateProcess to spawn a new PowerShell process, passing the decoded blob as arguments. This method is common for executing arbitrary commands and scripts while attempting to evade direct detection of the malicious payload on disk.

The decoded PowerShell script is a versatile Telegram bot client. It includes functions such as invoke_bot_cmd and invoke_bot_download. The invoke_bot_cmd function enables the threat actor to execute arbitrary commands on the victim's machine, with observed examples including whoami and ipconfig to gather system information. The invoke_bot_download function is responsible for exfiltrating "interesting and suspicious files" from the victim's machine back to the threat actor's Telegram botnet or C2 server. Other functionalities include sleep for delaying operations and cmd for spawning command prompt processes. The script directly interacts with Telegram API endpoints, using the embedded bot token to send and receive commands.

The Telegram bots themselves are a central component of Silent Lynx's C2 infrastructure. The threat actors were observed to name these bots with country names (e.g., "South Korea" for a bot targeting Kyrgyzstan), a likely attempt at misdirection. Analysis of the bot's chat logs revealed commands for establishing persistence on victim machines, often involving registry modifications using common HQ-based registry entries. Messages in Russian confirming "operation successfully completed" were observed in relation to persistence mechanisms. The bots were also used to download additional tools, including red-teaming tools like ReSocks, onto compromised systems.

The group's infrastructure extends beyond Telegram. They leverage Google Drive for hosting additional payloads and Pastebin for storing PowerShell commands that are downloaded and executed by victim machines. This reliance on legitimate services for malicious purposes helps them blend in with normal network traffic. Despite some observed operational security blunders, such as reusing the same implant for different targets (e.g., an implant intended for the Bank of Kyrgyzstan being deployed against Uzbekistan railways) and hardcoding sensitive C2 information, the group's continuous adaptation and use of diverse tools ensure its persistence. Newer campaigns observed by Group-IB further indicate the group's adoption of public exploits like PrintNightmare and commercially available web panels from underground forums to manage their growing network of compromised systems, with infrastructure identified in Azerbaijan.

Demo / Proof of Concept

▶ Watch: Latest findings: expanded targeting and operator subgroups (20:50)

While the presentation did not feature a live technical demonstration or proof of concept in the traditional sense, the speakers provided extensive visual evidence from their research. This included screenshots of the phishing emails, the decoy documents used to trick victims, and the decoded PowerShell scripts containing the Telegram bot C2 logic. They also showcased examples of Telegram bot chat logs, illustrating the commands issued by the threat actors and the responses from compromised machines, effectively demonstrating the group's operational methods and the technical underpinnings of their campaign.

Defensive Implications

▶ Watch: Conclusion: Evolving threat and continuous monitoring strategies (22:50)

The Silent Lynx campaign, with its ties to EuroTrooper, presents several critical implications for cybersecurity defenders, particularly for organizations in Central Asia, CIS, EU, and APAC regions, especially those in government, finance, and energy sectors.

First and foremost, enhanced email security is paramount. Organizations must deploy advanced phishing detection technologies capable of identifying highly targeted spear-phishing attempts, including those originating from compromised but seemingly legitimate government email addresses. Employee security awareness training should be continuously updated to educate users about the dangers of opening suspicious attachments, especially RAR and ISO files, and the trick of password-protected archives where the password is provided in the email itself. Users must be trained to scrutinize all email content, regardless of sender legitimacy.

Endpoint Detection and Response (EDR) solutions are crucial for detecting and preventing the execution of Silent Lynx's payloads. EDRs should be configured to monitor for suspicious process creation, particularly CreateProcess API calls that spawn PowerShell processes with encoded arguments. Detection rules should specifically flag PowerShell scripts attempting to connect to Telegram API endpoints, Google Drive, or Pastebin for command or payload retrieval. Monitoring for the execution of Golang or C++ binaries that exhibit reverse shell behavior or attempt to establish persistence via registry modifications is also vital.

Network monitoring and traffic analysis can help identify C2 communications. Organizations should implement network segmentation and egress filtering to block or alert on connections to known Telegram API domains (if not sanctioned), as well as suspicious downloads from public cloud storage services like Google Drive or code repositories like Pastebin. The presence of red-teaming tools like ReSocks or other penetration testing utilities on internal systems should trigger immediate alerts and investigation.

Proactive threat intelligence consumption is essential. Defenders must stay informed about the evolving TTPs, IOCs (Indicators of Compromise), and infrastructure used by Silent Lynx and its associated groups like EuroTrooper. Regular review of reports from security vendors like Seqrite, Cisco Talos, and Group-IB will provide actionable intelligence for updating detection rules and improving defensive postures.

Vulnerability management remains a foundational defensive measure. The group's observed use of public exploits, such as PrintNightmare, underscores the importance of promptly patching known vulnerabilities in operating systems and applications. A robust patch management program can significantly reduce the attack surface available to adversaries.

Finally, organizations, especially those in the targeted regions and sectors, should consider the broader implications of supply chain compromise. The use of compromised government emails to target other entities highlights how trust relationships can be exploited. Implementing stringent verification processes for external communications and attachments, even from seemingly trusted sources, can mitigate this risk. Continuous monitoring, adaptive defenses, and a proactive threat intelligence strategy are key to countering the persistent and evolving threat posed by Silent Lynx.

Key Takeaways

• Persistent Cyber Espionage: Silent Lynx is a highly active and persistent cyber espionage group, strongly linked to the previously identified EuroTrooper APT, primarily targeting government, financial, and critical infrastructure entities in Central Asian countries, with an expanding victimology across Asia.
• Adaptive TTPs and Diverse Arsenal: The group employs sophisticated spear-phishing with evolving initial access vectors (RAR, ISO, password-protected archives) and a blend of custom C++ loaders, Golang reverse shells, commodity RATs (WarZone RAT), open-source stealers (Stink Stealer), and red-teaming tools (ReSocks).
• Telegram Bots as Primary C2: A signature technique is the extensive use of Telegram bots for command and control, enabling command execution, data exfiltration, and persistence on victim machines, often via obfuscated PowerShell scripts embedding bot tokens.
• Operational Blunders Aid Attribution: Despite their persistence, Silent Lynx exhibits operational security blunders, such as reusing implants across different targets and hardcoding sensitive C2 information, which has aided researchers in attributing them to the Kazakhstan-affiliated EuroTrooper group.
• Expanding Toolkit and Infrastructure: The group continuously updates its toolkit, incorporating public exploits (e.g., PrintNightmare) and acquiring web panels from underground forums, while leveraging legitimate services like Google Drive and Pastebin for payload delivery and command staging.
• Urgent Call for Enhanced Defense: Defenders must implement comprehensive email security, advanced EDR, continuous network monitoring, and proactive threat intelligence to counter Silent Lynx's adaptive TTPs, focus on patching vulnerabilities, and educate users on sophisticated phishing threats.

About the Speaker(s)

Sathwik Ram Prakki is a Senior Security Researcher at Seqrite Labs, a division of Quick Heal. With four years of experience, he is an integral part of the APT team, focusing on tracking various targeted attacks, conducting in-depth malware analysis, and monitoring dark web forums for emerging threats.

Subhajeet Singha is a Threat Researcher at Seqrite. His work primarily involves extensive threat research, reverse engineering, hunting for information stealers and campaigns, and detection engineering, including the development of rules and signatures for threat detection.