A cyber espionage group known as Silent Lynx maintained persistent access to Tajikistan’s national railway network, collected more than 2,000 defence-related government documents and compromised a government-run geospatial platform in Uzbekistan. The operations, uncovered by CloudSEK researchers through an exposed server belonging to the group, also reveal how attackers used an AI agent to assist with reconnaissance, data collection and evidence cleanup.
The exposed server contained more than a dozen gigabytes of data, including malware, compromised credentials, collected government documents and operational records spanning April to October 2026.
Tajikistan’s Railway and Defence Correspondence Targeted
According to CloudSEK’s investigation, Silent Lynx maintained domain-level access to Tajikistan’s national railway network from mid-August until at least October 10, 2026. The attackers accessed multiple servers, extracted administrative credentials and collected internal operational reports and correspondence.
In a separate intrusion, the group used the credentials of a railway employee to access Tajikistan’s national electronic document management platform. Weak document-level access controls allowed the attackers to collect thousands of government records, including more than 2,000 unique documents involving the Ministry of Defence.
The collected material included military personnel transfers, flight-clearance requests, defence procurement correspondence, air-defence cooperation records and identity documents.
The investigation also uncovered a compromise of Uzbekistan’s Smart Forestry GeoServer, where attackers gained command execution, accessed the underlying database and established persistence.
AI Agent Used to Support Espionage Operations
One of the investigation’s significant findings was the use of a self-hosted AI agent built on the Hermes framework, primarily powered by DeepSeek models.
The operator used the agent to support reconnaissance, analyse collected information and perform operational cleanup. Its configuration also allowed certain destructive commands to run without additional approval.
Researchers discovered phishing lures impersonating Turkmenistan Railways and a regional administration, suggesting preparations for further targeting in Turkmenistan.
Evidence Suggests Kazakhstan Connection
CloudSEK attributed the exposed server to Silent Lynx with high confidence based on malware code markers, build paths and similarities with previously documented operations.
The investigation also identified operator test connections originating from residential internet services in Kazakhstan, including Kazakhtelecom. Combined with Russian-language instructions and operational patterns, these findings support earlier assessments of a possible Kazakhstan nexus, although attribution to Kazakhstan remains at medium confidence.
The exposed infrastructure provides a detailed record of the group’s intrusion methods, intelligence collection and use of AI-assisted tools in cyber espionage operations across Central Asia.
Full investigation: www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
Related
This entry was posted on November 11, 2026 at 7:42 am and is filed under Commentary with tags CloudSEK. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Cyber Espionage Group Silent Lynx Compromises Tajikistan Railway, Collects Thousands of Defence Documents
A cyber espionage group known as Silent Lynx maintained persistent access to Tajikistan’s national railway network, collected more than 2,000 defence-related government documents and compromised a government-run geospatial platform in Uzbekistan. The operations, uncovered by CloudSEK researchers through an exposed server belonging to the group, also reveal how attackers used an AI agent to assist with reconnaissance, data collection and evidence cleanup.
The exposed server contained more than a dozen gigabytes of data, including malware, compromised credentials, collected government documents and operational records spanning April to October 2026.
Tajikistan’s Railway and Defence Correspondence Targeted
According to CloudSEK’s investigation, Silent Lynx maintained domain-level access to Tajikistan’s national railway network from mid-August until at least October 10, 2026. The attackers accessed multiple servers, extracted administrative credentials and collected internal operational reports and correspondence.
In a separate intrusion, the group used the credentials of a railway employee to access Tajikistan’s national electronic document management platform. Weak document-level access controls allowed the attackers to collect thousands of government records, including more than 2,000 unique documents involving the Ministry of Defence.
The collected material included military personnel transfers, flight-clearance requests, defence procurement correspondence, air-defence cooperation records and identity documents.
The investigation also uncovered a compromise of Uzbekistan’s Smart Forestry GeoServer, where attackers gained command execution, accessed the underlying database and established persistence.
AI Agent Used to Support Espionage Operations
One of the investigation’s significant findings was the use of a self-hosted AI agent built on the Hermes framework, primarily powered by DeepSeek models.
The operator used the agent to support reconnaissance, analyse collected information and perform operational cleanup. Its configuration also allowed certain destructive commands to run without additional approval.
Researchers discovered phishing lures impersonating Turkmenistan Railways and a regional administration, suggesting preparations for further targeting in Turkmenistan.
Evidence Suggests Kazakhstan Connection
CloudSEK attributed the exposed server to Silent Lynx with high confidence based on malware code markers, build paths and similarities with previously documented operations.
The investigation also identified operator test connections originating from residential internet services in Kazakhstan, including Kazakhtelecom. Combined with Russian-language instructions and operational patterns, these findings support earlier assessments of a possible Kazakhstan nexus, although attribution to Kazakhstan remains at medium confidence.
The exposed infrastructure provides a detailed record of the group’s intrusion methods, intelligence collection and use of AI-assisted tools in cyber espionage operations across Central Asia.
Full investigation: www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server
Share this:
Like this:
Related
This entry was posted on November 11, 2026 at 7:42 am and is filed under Commentary with tags CloudSEK. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.