CloudSEK investigation uncovers persistent access to Central Asian government infrastructure, compromise of Uzbekistan’s Smart Forestry platform and possible links to Kazakhstan.
A cyber espionage group identified as Silent Lynx maintained access to Tajikistan’s national railway network, collected more than 2,000 defence-related government documents and compromised a government geospatial platform in Uzbekistan, according to a new investigation by CloudSEK.
Researchers uncovered the operation after discovering an exposed server containing more than a dozen gigabytes of data, including malware, stolen documents, credentials and operational records spanning April to October 2026.
Silent Lynx reportedly maintained domain-level access to Tajikistan’s railway network from mid-August until at least October 10. The attackers accessed multiple servers, extracted administrative credentials and collected internal operational reports and correspondence.
In a separate intrusion, stolen railway employee credentials were used to access Tajikistan’s national electronic document management platform. Weak document-level access controls enabled the collection of thousands of government records, including more than 2,000 unique documents involving the Ministry of Defence. These included military personnel transfers, flight-clearance requests, procurement correspondence and air-defence cooperation records.
“Attackers used an AI agent to support reconnaissance, data collection and operational cleanup, highlighting how AI is changing the execution of cyber espionage.”
The group also compromised Uzbekistan’s Smart Forestry GeoServer, gaining command execution, database access and persistence.
A significant finding was the use of a self-hosted AI agent built on the Hermes framework and powered primarily by DeepSeek models. The agent assisted with reconnaissance, information analysis, data collection and operational cleanup. Its configuration reportedly permitted certain destructive commands without additional approval.
CloudSEK also identified phishing lures impersonating Turkmenistan Railways and a regional administration, suggesting preparations for further targeting. Connections originating from Kazakhstan-based residential internet services, alongside Russian-language instructions and operational patterns, point to a possible Kazakhstan nexus, although attribution remains at medium confidence.
The investigation highlights how AI-assisted tools can support intelligence gathering and concealment, while weaknesses in identity management and document access controls expose critical government information.