Silent Lynx, a sophisticated threat group that has been tracked since 2024, continues its relentless espionage campaign against government entities across Central Asia.

Seqrite analysts identified the group as the first to assign this nomenclature, distinguishing it from multiple overlapping aliases including YoroTrooper, Sturgeon Phisher, and ShadowSilk.

The group has become notorious for orchestrating spear-phishing campaigns while impersonating government officials, specifically targeting governmental employees with malicious attachments designed to harvest sensitive information.

The threat group primarily leverages fabricated summit-related communications to distribute its weaponized payload.

Seqrite researchers noted that Silent Lynx demonstrates a pattern of hastily constructed campaigns targeting diplomatic entities involved in high-level international meetings.

The group’s operations extend across multiple Central Asian nations including Tajikistan, Azerbaijan, Russia, and China, with strategic focus on nations involved in cross-border infrastructure projects and diplomatic initiatives.

Seqrite analysts identified two distinct campaigns in 2025, both employing similar attack methodologies but targeting different geopolitical relationships.

The first campaign, discovered in October 2025, targeted diplomatic entities involved in Russia-Azerbaijan summit preparations, while the second focused on entities associated with China-Central Asian relations.

The timing and thematic consistency of these campaigns reveal a coordinated espionage operation driven by geopolitical interests rather than financial gain.

Infection Mechanism and Technical Arsenal

The infection chain begins with a deceptive RAR archive bearing benign filenames like “План развитие стратегического сотрудничества.pdf.rar” (Plan for Development of Strategic Cooperation).

When extracted, the archive reveals a malicious Windows shortcut file that abuses PowerShell.exe to download and execute obfuscated scripts from GitHub repositories.

The LNK file contains working directory metadata pointing to C:\Users\GoBus\OneDrive\Рабочий стол, serving as a pivot point for tracking additional campaigns.

The downloaded PowerShell script contains Base64-encoded reverse shell code that connects to remote command-and-control servers on port 443.

The decoded payload establishes a persistent TCP connection where it reads commands from operators, executes them via Invoke-Expression, and returns output across the same channel.

Seqrite researchers identified three primary implants deployed in these campaigns: Silent Loader (a C++ based downloader), Laplas (a TCP and TLS-based reverse shell), and SilentSweeper (a .NET implant capable of extracting and executing embedded PowerShell scripts).

The SilentSweeper implant accepts multiple arguments including -extract for writing embedded malicious PowerShell to disk and -debug for troubleshooting.

It reads a file named qw.ps1 from its Resources section, executes the contents, and downloads additional reverse shell payloads.

Beyond remote access, Seqrite analysts observed deployment of Ligolo-ng, an open-source tunneling tool, providing operators unrestricted command execution capabilities on compromised systems.

The multi-stage infection mechanism demonstrates sophisticated operational security awareness despite numerous OPSEC blunders that facilitated attribution and tracking.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Silent Lynx APT New Attack Targeting Governmental Employees Posing as Officials appeared first on Cyber Security News.

A critical security flaw in the WordPress Post SMTP plugin has left more than 400,000 websites vulnerable to account takeover attacks.

The vulnerability, identified as CVE-2025-11833, enables unauthenticated attackers to access email logs containing sensitive password reset information, potentially compromising administrator accounts and entire websites.

The flaw stems from a missing authorization check in the plugin’s core functionality, allowing threat actors to exploit logged email data without requiring any authentication credentials.

The Post SMTP plugin, designed to replace WordPress’s default PHP mail function with SMTP mailers, includes an email logging feature that inadvertently exposes critical security information.

Since November 1, 2025, attackers have actively targeted this vulnerability, with over 4,500 exploitation attempts already blocked by security systems.

The widespread use of this plugin across hundreds of thousands of WordPress installations has created a significant attack surface for cybercriminals seeking unauthorized access to websites.

Wordfence researchers identified the vulnerability through their Bug Bounty Program on October 11, 2025, just one day after its introduction.

Security researcher netranger discovered and responsibly reported the flaw, earning a bounty of $7,800 for the critical finding.

The WP Experts development team responded swiftly to disclosure, releasing patch version 3.6.1 on October 29, 2025, to address the security gap affecting all versions up to and including 3.6.0.

The vulnerability carries a CVSS score of 9.8, placing it in the critical severity category. Site administrators must immediately update to version 3.6.1 to protect their installations from ongoing exploitation attempts.

Wordfence Premium users received firewall protection on October 15, 2025, while free version users will receive the same safeguards by November 14, 2025.

Technical Exploitation Mechanism

The vulnerability resides within the PostmanEmailLogs class constructor, which displays logged email messages without performing capability checks on the __construct function.

Attackers can exploit this weakness by manipulating URL parameters to access arbitrary email logs through the plugin’s interface.

Vulnerability Details:-

The vulnerable code accepts GET requests with specific parameters including page, view, and log_id, allowing unauthorized users to retrieve stored email content directly from the database.

public function __construct() {
    global $wpdb;
    $this->db = $wpdb;
    $this->logger = new PostmanLogger( get_class( $this ) );

    //Render Message body in iframe
    if(
        isset( $_GET['page'] ) && $_GET['page'] == 'postman_email_log'
        &&
        isset( $_GET['view'] ) && $_GET['view'] == 'log'
        &&
        isset( $_GET['log_id'] ) && !empty( $_GET['log_id'] )
    ) {
        $id = sanitize_text_field( $_GET['log_id'] );
        $email_query_log = new PostmanEmailQueryLog();
        $log = $email_query_log->get_log( $id, '' );
        echo ( isset ( $header ) && strpos( $header, "text/html" ) );
        die;
    }
}

The exploitation process involves attackers triggering password reset requests for administrator accounts, then accessing the logged reset emails containing password reset links through the unprotected interface.

This two-step attack vector enables complete site takeover, granting malicious actors full administrative privileges to upload backdoors, modify content, and redirect users to malicious destinations.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post WordPress Post SMTP Plugin Vulnerability Exposes 400,000 Websites to Account Takeover Attacks appeared first on Cyber Security News.