Search — “CVE-2025-25257”

Silent Lynx, tracked by Cisco Talos as UAT-6275 and by Recorded Future as TAG-193, ran four infection chains against CIS government organizations from June 2025 to August 2026. Chains used macro-enabled Word documents, PS2EXE downloaders that create scheduled tasks, LNK files in RAR archives launching PowerShell that fetches a GitHub-hosted script, and a RAR exploiting CVE-2025-8088 to drop PickleShell into the Windows Startup folder. Hunters should look for PowerShell or LNK-launched interpreters fetching from GitHub, new scheduled tasks created by PS2EXE-packaged executables, and new files in Startup folders.