Loading malware…
Chvost is a lightweight Windows reverse shell used by Silent Lynx in activity tracked as UAT-6275 and TAG-193. It provides interactive remote access, allowing operators to issue commands on compromised systems and receive their output. The earliest identified sample was compiled in June 2022. Chvost evolved from plaintext TCP communication to TLS using statically linked OpenSSL and incorporates XOR-based obfuscation. Analyzed implementations make a single connection attempt and lack anti-debugging checks.
Chvost has been deployed in spear-phishing operations targeting government organizations across Central Asia and the wider Commonwealth of Independent States. Associated campaigns focus on institutions responsible for diplomacy, economic development, agriculture, environmental management, and energy. A Turkmenistan-themed delivery chain used a PS2EXE-packaged PowerShell downloader to retrieve an archive and a PDF decoy, deploy Chvost, and establish persistence through an hourly scheduled task. Chvost forms part of Silent Lynx’s broader toolkit of custom reverse shells, alongside FoalShell, Laplas, and PickleShell.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These attacks lead to the deployment of custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell, facilitating interactive remote access to compromised hosts.
Нападите доведуваат до инсталирање прилагодени обратни школки (Reverse Shell), како што се FoalShell, Chvost, Laplas и PickleShell.
Нападите доведуваат до инсталирање прилагодени обратни школки (Reverse Shell), како што се FoalShell, Chvost, Laplas и PickleShell.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Silent Lynx routinely uses compromised email accounts to deliver spear-phishing emails containing malicious documents to targeted victims.
It also establishes persistence by creating a scheduled task named WindowsUpdate, which re-runs the VBScript every six minutes.
Silent Lynx’s campaign relies heavily on various lightweight, interactive reverse shells to perform command and control in their operations.
It also establishes persistence by creating a scheduled task named WindowsUpdate, which re-runs the VBScript every six minutes.
It also establishes persistence by creating a scheduled task named WindowsUpdate, which re-runs the VBScript every six minutes.
Spear-phishing campaigns that distribute RAR archives that contain PS2EXE-generated binaries
The dropped payload, which we refer to as PickleShell, is an x64 .NET Framework reverse shell that masquerades as the Windows Distributed Transaction Coordinator service.
A scheduled task named MicrosoftOfficeUpdate
The macro then initiates C2 communication and downloads a binary from the embedded URL http://178[.]128[.]40[.]89:8989/shell.exe.
The actor’s GitHub-hosted PowerShell reverse shell (456.ps1) initiates an outbound TCP connection to this listener and executes commands received from the server.
These scripts acted as launchers that downloaded and deployed the PickleShell payload to the Windows Startup folder.
During the April-May 2026 campaign wave, we identified a new C#/.NET reverse shell that supports SSL/TLS encryption for its C2 channel.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.