Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighbouring Nations

Seqrite Labs reports two coordinated phishing campaigns attributed to a group named Silent Lynx targeting Kyrgyzstan government entities (National Bank and Ministry of Finance). The attacks use RAR/ISO lures delivering a C++ loader that runs a Base64-encoded PowerShell implant (which uses a Telegram bot for command & control and data exfiltration) and a separate Golang reverse-shell implant; the report includes technical analysis, IOCs (hashes, domains, Telegram bot tokens), infrastructure findings, and a medium-confidence attribution linking Silent Lynx to the Kazakhstan-aligned YoroTrooper group.