Silent Lynx Exploits WinRAR RCE Flaw to Deploy Reverse Shells in CIS Government Networks
What Happened — The threat group Silent Lynx leveraged a publicly‑known remote‑code‑execution vulnerability in WinRAR (CVE‑2023‑40477) to deliver reverse‑shell payloads to government organizations across the Commonwealth of Independent States. The campaign, observed from June 2025 through August 2026, used macro‑enabled documents, PS2EXE downloaders, GitHub‑hosted PowerShell scripts, and specially crafted WinRAR archives.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of un‑patched third‑party utilities and the need for a documented, continuously‑monitored vulnerability‑management process.
- Provides a concrete example of why auditable evidence of patch status, remediation timelines, and control effectiveness is essential for a defensible audit trail.
- Aligns with the control objective of “maintaining effective vulnerability remediation” and can be validated through Verisq’s Control Mapping capability, which aggregates evidence across frameworks.
Who Is Affected – Government agencies and related contractors operating in the CIS region that rely on WinRAR for archive handling.
Recommended Actions –
- Inventory all WinRAR installations and verify they run version 6.2.1 or later.
- Apply the vendor‑issued patch for CVE‑2023‑40477 immediately.
- Disable macro execution in office documents and restrict the use of PS2EXE downloaders.
- Implement continuous monitoring of archive‑processing logs to capture anomalous activity and retain evidence for audit readiness. Source: The Hacker News
Technical Notes – Attack vector: malicious RAR archive exploiting CVE‑2023‑40477 (remote code execution). Payload delivered via PowerShell and reverse‑shell binaries. Data types: system command execution, potential credential theft. Source: The Hacker News