A hacking group suspected to be linked to Kazakhstan utilized an artificial intelligence agent to conduct espionage on Central Asian governments, according to a report from cybersecurity firm CloudSEK. The findings emerged after researchers discovered an exposed server associated with the group known as Silent Lynx, which has a history of targeting nations including Kyrgyzstan, Turkmenistan, Tajikistan, Armenia, Belarus, and Russia.
The exposed server housed over a dozen gigabytes of sensitive data, including stolen government documents and hacking tools. The research indicates that the hackers employed Hermes, an open-source AI agent, to streamline their operations. This AI, developed using models from the Chinese company DeepSeek, was designed to act as an offensive cybersecurity expert capable of executing commands without human intervention.
Researchers disclosed that the AI agent facilitated activities such as reconnaissance and data collection, while also helping erase traces of the hackers’ actions from compromised systems. The operator communicated with Hermes in Russian and connected it to a Telegram bot, allowing remote command issuance through a mobile phone.
Government networks compromised
Among the group’s notable breaches was an extended intrusion into Tajikistan’s national railway network, maintaining access from mid-August to early October. Once inside, the hackers extracted databases with login credentials and stole internal documents and operational reports.
Using the credentials of a railway employee, the attackers accessed Tajikistan’s national electronic document management platform, utilized for official communications among various government agencies. They developed automated methods to download substantial numbers of files, including thousands related to the country’s Defense Ministry.
Other stolen documents encompassed correspondence from the National Guard, the State Committee for National Security, the State Investment Committee, and detailed information about over 100 government organizations and their personnel.
In addition, CloudSEK found indications that the group compromised a server linked to Uzbekistan’s Smart Forestry initiative, a governmental platform designed for forest resource management. The exposed server also contained malicious files disguised as official documents from Turkmenistan, suggesting preparations for a phishing campaign, although the success of these efforts remains unclear.
CloudSEK assessed, with medium confidence, that Silent Lynx has connections to Kazakhstan, citing Russian-language communications and internet connections traced back to a residential provider in the country. This aligns with previous assessments indicating the group operates from Kazakhstan, though no direct links to the Kazakh government have been established.
Active since at least 2022, Silent Lynx, also known as Cavalry Werewolf and YoroTrooper, has focused on government agencies, diplomatic entities, and other institutions in Central Asia, Russia, and Europe. The group launched a prolonged cyberespionage campaign against Russian government agencies and industrial firms in October 2025, using phishing emails disguised as correspondence from Kyrgyz officials.
