A campaign attributed to the threat actor Silent Lynx has struck government organisations across the Commonwealth of Independent States (CIS), according to research reported by The Hacker News. The identity of the adversary, however, is the least useful part of the story for most readers. The toolkit is what matters.
The activity, tracked from June 2025 through August 2026, runs along four distinct infection chains: macro-enabled documents, PS2EXE downloaders, PowerShell scripts pulled from GitHub, and crafted WinRAR archives that ultimately drop a reverse shell. There is nothing exotic in that list. Every component turns up in ordinary enterprise environments every day.
The reusable lesson is the tooling, not the actor
To be clear: Silent Lynx has not been observed targeting Hong Kong or the wider APAC region. The confirmed victims are CIS government bodies. What travels is the tradecraft — and it travels well, appearing wherever macro policies are loose, PowerShell egress is unrestricted, or archiving utilities sit unpatched for years.
Each of the four chains exploits a categorisation gap rather than a novel weakness. Macro documents outlive their business justification and keep running. PS2EXE artifacts sit between script and binary controls, so neither picks them up cleanly. Outbound traffic to code-hosting platforms such as GitHub is assumed benign and left unfiltered. Archiving utilities are treated as inert plumbing rather than managed software — even though they execute attacker-supplied content with the privileges of the logged-in user. Once a foothold is established, the reporting suggests maintaining access posed little difficulty.
That combination — commodity tooling, standard delivery routes, familiar defensive blind spots — is why a CIS-focused campaign has implications well beyond the CIS.
One recurring blind spot, four ways in
The through-line across all four chains is a maintenance gap, not a sophisticated exploit. Macro-enabled documents succeed because legacy exceptions are never retired. PS2EXE downloaders slip past controls built for one artefact class. GitHub-hosted PowerShell works because egress to raw repository endpoints is rarely logged. And the WinRAR archives land because archiving software lives in an ownership void between desktop engineering and security: pre-installed, rarely inventoried, almost never on a patch register.
For IT teams, that makes the campaign a useful forcing function for four unglamorous but overdue tasks:
- Inventory and patch WinRAR across all managed endpoints. Verify the deployed version rather than assuming it matches the software distribution image, and pay particular attention to servers, jump hosts, and shared workstations — the machines most likely to sit outside normal desktop patching.
- Enforce macro policy centrally, restricting document-launched automation to a documented allowlist, and review legacy exceptions that may have outlived their original business case.
- Apply egress controls and logging to PowerShell download activity from public repositories, including GitHub raw endpoints, which are commonly assumed benign.
- Alert on reverse-shell behaviour originating from archive-extraction or document-launcher processes — the point where these chains converge.
One caveat worth flagging before anyone starts ticketing: the source reporting does not cite a specific CVE identifier for the WinRAR weakness being exploited. Administrators should work from WinRAR vendor advisories and their own inventory data, not from second-hand write-ups — a small reminder that verifying your own software state remains the only reliable baseline.
Bottom line
Silent Lynx is a single actor; the four delivery methods it relied on are fixtures of everyday enterprise networks. Whether or not similar activity reaches APAC shores, the cost of closing the exposure is low: patch the archiver, constrain the macro, filter the egress, and watch for the shell.
據The Hacker News報道的研究顯示，一場歸屬為威脅行為者Silent Lynx的攻擊行動，已攻擊獨立國家聯合體（CIS）多個國家的政府機構。然而對大多數讀者而言，對手的身份並非重點，真正值得注意的是其所使用的攻擊工具。
該行動從2025年6月持續至2026年8月，涉及四條截然不同的感染鏈：啟用巨集（macro）的文件、PS2EXE 下載器、從 GitHub 擷取的 PowerShell 腳本，以及最終投放 reverse shell 的經篡改 WinRAR 壓縮檔。這份清單中沒有任何罕見手法——每一個元素每日都在一般企業環境中出現。
可借鑑的教訓是工具與手法，而非行動者本身
必須澄清：目前並未觀察到Silent Lynx針對香港或整個亞太地區發動攻擊，已確認的受害者為CIS政府機構。真正會擴散的是其 tradecraft（攻擊手法）——而且傳播得很快，凡是在巨集政策寬鬆、PowerShell 出站流量不受限制，或壓縮工具多年未修補的地方，便會出現其蹤影。
上述四條攻擊鏈所利用的皆非全新漏洞，而是分類上的盲點。啟用巨集的文件在業務需要早已不存在的情況下仍持續運行；PS2EXE 產物介乎 script 與 binary 的管制範疇之間，令兩者都無法有效攔截；前往 GitHub 等代碼託管平台的出站流量被視為 benign 而未加過濾；壓縮工具則被當成 inert 的基建配套，而非需要管理的軟件——但它實際上會以已登入用戶的權限執行攻擊者提供的內容。報道指出，一旦 foothold 建立，維持存取幾乎不費吹灰之力。
這三者的組合——commodity 工具、標準投遞途徑、熟悉的防禦盲點——正是為何一場針對CIS的攻擊行動，其影響遠超CIS範圍的原因。
一個反覆出現的盲點，四個入侵途徑
貫穿四條攻擊鏈的主線是維護上的漏洞，而非高深的 exploit。啟用巨集的文件屢屢得手，是因為 legacy 例外一直未被撤銷；PS2EXE 下載器能繞過管制，是因為現有措施只針對單一 artefact 類別而建；GitHub 托管的 PowerShell 得以運作，是因為通往 raw repository endpoint 的出站流量極少被記錄；WinRAR 壓縮檔得以成功投放，則是因為壓縮軟件處於 desktop engineering 與安全團隊之間的責任真空：預先安裝、極少納入 inventory、幾乎從不出現在修補登記表上。
對 IT 團隊而言，這場攻擊行動正好是推動四項乏味但拖延已久任務的契機：
- **盤點並修補所有受管終端的 WinRAR。**核實實際部署版本，而非假設其與軟件分發映像一致；尤其要留意 server、jump host 及共享工作站——這些機器最常脫離正常桌面修補流程。
- 集中執行巨集政策，將文件啟動的自動化功能限制於有記錄的 allowlist 之內，並檢視可能已過時的 legacy 例外。
- 對來自公開 repository 的 PowerShell 下載活動實施 egress 管制及記錄，包括常被誤判為 benign 的 GitHub raw endpoint。
- 就源自壓縮解壓或文件啟動程序的 reverse-shell 行為設置警示——這是四條攻擊鏈的交匯點。
在任何人着手處理工單之前，有一點必須留意：原始報道並未指出被利用的 WinRAR 漏洞對應的特定 CVE 編號。管理員應根據 WinRAR 廠商公告及自身 inventory 數據行事，而非依賴二手分析文章——這是對「自行核實軟件狀態仍是唯一可靠基準」的一次小小提醒。
總結
Silent Lynx 只是一個行為者；其所依賴的四種投遞方式，卻是日常企業網絡的常態配置。無論類似活動是否波及亞太地區，封堵相關風險的成本都很低：修補壓縮軟件、限制巨集、過濾出站流量，並監察 shell 活動。