Kazakhstan Hackers Use AI to Spy on Central Asian Governments

Singapore-based cybersecurity firm CloudSEK has uncovered an espionage operation in which suspected Kazakhstan-linked hackers used an artificial intelligence agent to infiltrate critical infrastructure and government networks across Central Asia. The threat actor, identified as Silent Lynx, breached Tajikistan's national railway network and compromised its central document exchange platform to steal sensitive ministerial records. The attackers also gained access to an environmental management server in Uzbekistan and prepared phishing operations against Turkmenistan. The campaign demonstrates how automated software agents can independently perform network reconnaissance, extract confidential documents, and erase operational traces from compromised systems.

Key Facts

How Did the Attackers Use Artificial Intelligence?

The threat actor deployed Hermes, an open-source artificial intelligence agent powered primarily by models developed by Chinese firm DeepSeek. Unlike conventional chatbots, the agent was configured as an offensive specialist capable of running software, conducting automated reconnaissance, harvesting confidential documents, and erasing operational traces directly from compromised target systems.

CloudSEK identified an exposed server containing more than a dozen gigabytes of data belonging to Silent Lynx. Analysis showed the human operator issued instructions in Russian via a Telegram bot connected to a mobile phone. This architecture enabled the operator to dispatch remote commands while the agent executed multi-step tasks autonomously, including running potentially destructive commands without requiring additional approval.

The Hermes agent operated via Telegram commands to automate reconnaissance, document harvesting, and log deletion across compromised networks.

Which Central Asian Government Networks Were Infiltrated?

The espionage campaign compromised state networks in Tajikistan and Uzbekistan. The attackers maintained persistent access to Tajikistan's national railway from mid-August through early October, using a single employee's credentials to infiltrate the national electronic document management platform shared across government ministries and state security committees.

After breaching the railway servers, the group extracted databases containing login credentials and operational reports. They used automated tools to extract thousands of official documents, including files processed by Tajikistan's Defense Ministry in 2026, alongside correspondence from the National Guard, the State Committee for National Security, and the State Investment Committee. In total, information concerning more than 100 government organisations and their employees was stolen. The attackers also compromised a server supporting Uzbekistan's Smart Forestry platform and developed malicious files disguised as official railway tickets and regional reports to prepare phishing campaigns against Turkmenistan.

Attackers leveraged stolen credentials from one railway worker to access Tajikistan's inter-ministerial document exchange platform and extract sensitive state communications.

What Is Known About the Silent Lynx Group and Its Attribution?

CloudSEK assessed with medium confidence that Silent Lynx has ties to Kazakhstan, citing Russian-language communications and test connections originating from a residential internet service provider in the country. However, researchers emphasised that these findings do not establish any link or operational connection to the Kazakh government.

Silent Lynx, which security researchers also track as Cavalry Werewolf and YoroTrooper, has maintained active cyber operations since at least 2022. The group has repeatedly targeted government agencies, diplomatic missions, and critical infrastructure across Central Asia, Russia, and Europe. In October 2025, the group launched a prolonged cyberespionage campaign against Russian industrial firms and government bodies, utilizing phishing emails disguised as official correspondence from the government of Kyrgyzstan.

Silent Lynx has operated cyberespionage campaigns since at least 2022 against targets in Europe and Central Asia without confirmed ties to the Kazakh state.

What Should You Do?

• Note lack of software fix: No vendor software patch is currently available, as the campaign relied on valid stolen credentials, automation scripts, and deceptive lure documents rather than a specific unpatched software vulnerability.
• Audit and rotate user credentials: Enforce immediate credential resets and multi-factor authentication across all external-facing and inter-agency portals to prevent single compromised accounts from enabling lateral movement into centralised platforms.
• Train personnel against phishing lures: Heighten employee vigilance regarding unsolicited attachments; the threat group has disguised malicious payloads as regional government reports and railway tickets.
• Report suspected incidents: Malaysian organisations suspecting unauthorised access or related compromise should report incidents directly to Cyber999 via the Malaysia Computer Emergency Response Team (MyCERT).

Common Questions

What is the Hermes AI agent and how did it function?

Hermes is an open-source artificial intelligence agent configured for offensive cybersecurity operations. Powered primarily by DeepSeek models, the agent operates autonomously to execute commands, run tools, gather intelligence, and wipe logs on compromised networks based on instructions received from a human controller via Telegram.

How did the group compromise Tajikistan's ministerial documents?

The threat group gained initial access to Tajikistan's railway network and extracted employee login credentials. Using credentials from one employee, the hackers logged into the national electronic document management platform and deployed automated tools to download thousands of official ministerial records, including defence and state security files.

Is Silent Lynx confirmed to be an arm of the Kazakh government?

No. CloudSEK assessed with medium confidence that Silent Lynx is based in Kazakhstan due to residential internet connections and Russian communications. However, the investigation found no evidence connecting the group to the Kazakh government, and no state sponsorship has been confirmed by researchers.

Sources and Methodology

This dispatch is based solely on reporting by The Record from Recorded Future News, published on Wednesday. Full reporting is available at The Record. No other documents, vendor advisories, or external sources were reviewed.