Kazakhstan-linked hackers used AI agent to spy on Central Asian governments

CloudSEK found an exposed server belonging to the hacking group Silent Lynx containing over a dozen gigabytes of stolen government documents, hacking tools and records showing an operator used the open-source Hermes AI agent, built mainly on DeepSeek models, for reconnaissance, data collection and erasing traces. The group maintained extensive access to Tajikistan's national railway network from at least mid-August to early October and used a single employee's credentials to reach Tajikistan's national electronic document management platform, also compromising a server supporting Uzbekistan's Smart Forestry initiative. CloudSEK assessed with medium confidence that Silent Lynx is tied to Kazakhstan based on Russian-language communications and test connections from a Kazakh residential internet provider, without establishing any link to the Kazakh government.