Plan
active
Silent Lynx Exploits WinRAR in CIS Government Campaign
- Engineer — Learn: No CVE or patch version is named, no enrichment signals exist, and targets are CIS government entities — nothing actionable for patching or configuration today, but the WinRAR exploitation chain is worth tracking if a specific CVE surfaces.
- SOC/IR — Plan: The multi-stage chain — macro-enabled lures → PS2EXE dropper → GitHub-hosted PowerShell C2 → WinRAR delivery — maps to detectable ATT&CK behaviors; consider building or tuning detections for GitHub-domain PowerShell callbacks and PS2EXE execution patterns this quarter.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.