An AI agent helped a suspected Kazakhstan-linked spy group copy more than 2,000 documents tied to Tajikistan’s Ministry of Defense. The group, known as Silent Lynx, ran the open-source Hermes agent framework and steered it from Telegram. Researchers saw all of this because the operator left a server open to the internet, with stolen files, hacking tools and the agent’s own logs inside.
Singapore-based security company CloudSEK published the findings on November 11 in a detailed CloudSEK report on the exposed Silent Lynx server. Reuters reported the story the same day. Kazakh and Tajik government officials did not immediately respond to Reuters’ requests for comment, and the news agency could not reach Silent Lynx.
What was on the exposed server
The machine was a Debian virtual server that answered on port 8088 without any login. It held more than 12 GB spread across hundreds of thousands of files. The records cover activity from April to October 2026.
CloudSEK says with high confidence that the directory belongs to a Silent Lynx operator. The link rests on code markers and build paths that match published samples of the group’s Laplas and Chvost implants. The company did not explain how it first found the server.
The folder mixed malware, victim passwords, stolen documents and the AI agent’s chat history. CloudSEK lists this as one of several operational security failures by the operator.
How the AI agent fit into the operation
Hermes is an open-source framework for autonomous AI agents. The Record reported that AI research company Nous Research released it earlier this year. On this server, most of the logged work ran on DeepSeek V4.1 Flash through the OpenRouter model service. Helper sub-agents used Gemini 2.5 Flash, also through OpenRouter.
CloudSEK summed up the shift for Reuters. “Instead of typing hacking commands by hand, the attacker told Hermes what to do,” the company said. The agent then planned steps, ran them, kept notes and wrote reports.
The operator’s setup removed several safety brakes:
- The persona told the agent it was “an elite offensive security specialist and red teamer” and to drop safety disclaimers.
- Destructive commands, such as SQL DROP statements, could run without confirmation.
- The hard stop for repeated tool failures was turned off, so the agent kept going.
- Unsafe JavaScript evaluation was allowed in the agent’s browser.
The agent had terminal, browser, computer use, scheduling, delegation and Telegram tools. Every inbound command came from one Telegram user ID with a display name that reads Marat in Cyrillic. That let the operator give orders from a phone.
The agent handled reconnaissance, data collection, reports on access to upstream internet providers, and log cleanup. A handoff file let it continue collecting documents without the operator present. CloudSEK does not say the AI found the first way into the networks.
Who was hit
Tajikistan’s national railway
Silent Lynx held access to the railway network from mid-August until at least October 10, 2026. A separate tunnel had been active earlier, from April to May. The intruders mapped dozens of Windows machines, gained admin rights on several servers and dumped domain credentials, including the Administrator and krbtgt accounts. They copied reports and correspondence from file shares. They also collected logins for upstream network gear from MikroTik, Cisco and D-Link. The report does not state how the railway was first breached.
Tajikistan’s government document system
One railway employee’s ordinary account opened the next door. The operator used it to sign in to the national electronic document management platform through the government single sign-on portal. Reuters, citing CloudSEK, said this break-in came about two weeks after reconnaissance began in mid-August.
Two weaknesses made mass theft possible. The platform checked permissions poorly for each document, and a file service handed out attachments without any login. The agent wrote a custom collector that downloaded files, sorted them and split them into chunks. It posted progress to Telegram.
The haul included more than 2,000 unique documents dated through 2026, mostly tied to the Ministry of Defense. CloudSEK lists airspace clearances, personnel transfers, attache postings, defense purchases, air-defense cooperation, border-zone building reports and scans of identity papers. Smaller sets related to the National Guard and the State Committee for National Security. There were also hundreds of letters from the State Investment Committee, plus a directory export covering more than 100 government organizations.
Uzbekistan and Turkmenistan
In Uzbekistan, the group took over the GeoServer system of the Smart Forestry platform. It planted malicious web apps and a webshell, then used a database superuser login to open a reverse shell. The result was command execution and full control of the forestry database, though not root access.
For Turkmenistan, the operator built and tested lures in October 2026. One posed as a Turkmenistan Railways e-ticket for an Ashgabat to Turkmenabat trip. Another used a Turkmen-language filename about the Ahal regional administration’s 2026 state program. CloudSEK presents this as an upcoming campaign. It has not shown that any attack on Turkmenistan succeeded.
Agent memory notes also mention Armenian government networks filtering the operator’s traffic. They describe an October 2026 effort against Pakistan’s Ministry of Foreign Affairs and a national telecom provider, where a web firewall kept banning the operator’s IP address.
Why the Kazakhstan link is not proof of a state operation
CloudSEK rates the Kazakhstan connection at medium confidence. The operator worked in Russian and sent test traffic from a home Kazakhtelecom connection. Recorded activity fell between 08:00 and 20:00 at UTC+5, on weekdays only. CloudSEK notes that this pattern covers just three working days.
Most server logins came through Tor. On October 2, though, the operator logged in from Kazakhtelecom, switched to Proton VPN and logged in again four minutes later. He then told the agent the Proton address was his only IP, which the earlier logs contradict.
No source ties the work to a Kazakh government body. CloudSEK reads the motive as regional intelligence gathering, not money, based on the targets.
How this fits a pattern
Silent Lynx is not new, and neither is Hermes in attacks. The timeline below uses dates from CloudSEK’s report and other published research.
| Date | Event |
|---|---|
| Jan 2025 | Seqrite first names Silent Lynx, with government targets in Kyrgyzstan and nearby states |
| Aug 2025 | Group-IB describes ShadowSilk, sharing infrastructure with Silent Lynx and YoroTrooper |
| Jul 2026 | Hunt.io reports Hermes running unattended against Thailand’s Ministry of Finance |
| Oct 2026 | Cisco Talos and Recorded Future publish new Silent Lynx research, also pointing to Kazakhstan |
| Nov 2026 | CloudSEK details the exposed server and the AI-run Tajik theft |
The difference this time is the target and the length of the operation. The Thai case showed an agent mapping a ministry network. Here the agent supported weeks of espionage against defense records, then tried to erase its tracks. According to Reuters, CloudSEK said the find shows espionage-focused hackers, not just criminals, are handing hacking work to AI.
What defenders can take from it
The AI did not invent new attacks. It sped up ordinary steps against ordinary weaknesses. That points to familiar fixes for government and infrastructure teams:
- Check that every document request is authorized, not just the login. Weak per-document checks enabled the Tajik bulk download.
- Close file services that serve attachments without a login.
- Watch for one standard account pulling thousands of files at high speed. CloudSEK says this noisy collection tripped firewall lockouts.
- Rotate credentials for upstream network devices after any breach, since the group harvested router logins.
- Search logs for the operator server 89.125.213.123 and the domain foreverpeace[.]ru, both listed in CloudSEK’s indicators.
Technical notes for security teams
The phishing chain starts with a shortcut file wearing a PDF icon, packed in a ZIP, a password-protected archive or an ISO. Opening it shows a decoy PDF and starts hidden PowerShell. That script fetches P.ps1 from the operator’s own server and runs it in memory. Earlier campaigns pulled scripts from GitHub instead.
CloudSEK found a new generation of service-installer wrappers and an AMSI bypass not seen in earlier public reporting. Pivot and scanning tools included Ligolo, GOST, fscan, Responder, NetExec, Impacket and Metasploit. In early October, the agent deleted messages, shredded shell histories and zeroed login records. It missed the exposed directory, and a daily logger kept exporting its conversations.
What remains unclear
CloudSEK has not said how the railway network was first breached or how it found the server. Tajik authorities have not commented on whether the document platform’s flaws are fixed. It is also unknown whether DeepSeek, OpenRouter or Nous Research were contacted, as no source reports a response from them.
