Kazakhstan-linked hackers used AI agent to spy on Central Asian governments

CloudSEK researchers found an exposed server belonging to Silent Lynx, an espionage group they assess with medium confidence is based in Kazakhstan, containing more than a dozen gigabytes of stolen government documents and records showing the operator used an AI agent — the open-source Hermes, running mainly on DeepSeek models and controlled through a Telegram bot — to automate reconnaissance, data collection and cleanup. The group held extensive access to Tajikistan’s national railway network from mid-August to early October and used one employee’s credentials to pull thousands of documents, including Defense Ministry files, from the national document platform.