{"id":4270,"date":"2025-02-10T10:45:55","date_gmt":"2025-02-10T10:45:55","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/silent-lynx-a-multi-stage-cyberattack-via-powershell-go-and-c-loaders\/"},"modified":"2025-02-10T10:45:56","modified_gmt":"2025-02-10T10:45:56","slug":"silent-lynx-a-multi-stage-cyberattack-via-powershell-go-and-c-loaders","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/silent-lynx-a-multi-stage-cyberattack-via-powershell-go-and-c-loaders\/","title":{"rendered":"Silent Lynx: A Multi-Stage Cyberattack via PowerShell, Go, and C++ Loaders"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Feb 05, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Threat Intelligence \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A previously undocumented threat actor known as Silent Lynx has been linked to cyber attacks targeting various entities in Kyrgyzstan and Turkmenistan.<\/p>\n

“This threat group has previously targeted entities around Eastern Europe and Central Asian government think tanks involved in economic decision making and banking sector,” Seqrite Labs researcher Subhajeet Singha said<\/a> in a technical report published late last month.<\/p>\n

Targets of the hacking group’s attacks include embassies, lawyers, government-backed banks, and think tanks. The activity has been attributed to a Kazakhstan-origin threat actor with a medium level of confidence.<\/p>\n

\"Cybersecurity\"<\/a><\/center><\/div>\n

The infections commence with a spear-phishing email containing a RAR archive attachment that ultimately acts as a delivery vehicle for malicious payloads responsible for granting remote access to the compromised hosts.<\/p>\n

The first of the two campaigns, detected by the cybersecurity company on December 27, 2024, leverages the RAR archive to launch an ISO file that, in turn, includes a malicious C++ binary and a decoy PDF file. The executable subsequently proceeds to run a PowerShell script that uses Telegram bots (named “@south_korea145_bot” and “@south_afr_angl_bot”) for command execution and data exfiltration.<\/p>\n

\"\"<\/a><\/div>\n

Some of the commands executed via the bots include curl commands to download and save additional payloads from a remote server (“pweobmxdlboi[.]com”) or Google Drive.<\/p>\n

The other campaign, in contrast, employs a malicious RAR archive containing two files: A decoy PDF and a Golang executable, the latter of which is designed to establish a reverse shell to an attacker-controlled server (“185.122.171[.]22:8082”).<\/p>\n

\"Cybersecurity\"<\/a><\/center><\/div>\n

Seqrite Labs said it observed some level of tactical overlaps between the threat actor and YoroTrooper<\/a> (aka SturgeonPhisher), which has been linked to attacks targeting the Commonwealth of Independent States (CIS) countries using PowerShell and Golang tools.<\/p>\n

“Silent Lynx’s campaigns demonstrate a sophisticated multi-stage attack strategy using ISO files, C++ loaders, PowerShell scripts, and Golang implants,” Singha said.<\/p>\n

“Their reliance on Telegram bots for command and control, combined with decoy documents and regional targeting which also highlights their focus on espionage in Central Asia and SPECA based nations.”<\/p>\n

<\/p>\n

Found this article interesting? Follow us on Twitter \uf099<\/i><\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n<\/div>\n