Kazakhstan-linked hackers used AI agent to spy on Central Asian governments

The server contained over a dozen gigabytes of data, including stolen government documents, hacking tools and records showing how an attacker used an AI agent named Hermes to automate parts of the operation. The system primarily used AI models developed by Chinese company DeepSeek.

AI capabilities

Unlike conventional chatbots, the AI agent could execute commands, run software and carry out tasks on behalf of its user. It assisted with reconnaissance, data collection and erasing traces of activity from compromised systems.

Government networks compromised

One of the group's most significant intrusions targeted Tajikistan, where the hackers maintained extensive access to the national railway network from at least mid-August through early October. After breaking into the network, they gained access to servers, extracted databases containing login credentials and stole internal documents.

Using credentials of a single railway employee, they logged into Tajikistan's national electronic document management platform, which government ministries use to exchange official correspondence. The group developed automated tools to download thousands of documents, including those from the Defense Ministry.

Regional targets

CloudSEK also found evidence the group had compromised a server supporting Uzbekistan's Smart Forestry initiative. The exposed server contained malicious files disguised as official documents from Turkmenistan, suggesting preparation for another phishing campaign.

CloudSEK assessed with medium confidence that Silent Lynx has ties to Kazakhstan, citing Russian-language communications and test connections from a Kazakh residential internet provider. The group, also tracked as Cavalry Werewolf and YoroTrooper, has been active since at least 2022 and previously targeted government agencies across Central Asia, Russia and Europe.