The Kazakhstan-linked cyber espionage operation targeting Tajikistan is raising some interesting questions about just how much of the hacking process criminals can now hand off to AI agents, and how easily those operations can hide in plain sight. Don’t know what I am talking about? This might help: Kazakhstan-linked hackers used AI to steal Tajik government documents, researchers say
And this might help as well: https://itnerd.blog/2026/11/11/cyber-espionage-group-silent-lynx-compromises-tajikistan-railway-collects-thousands-of-defence-documents/
John Strand, Owner, Black Hills Information Security:
“Attackers have been using public platforms to send instructions to malware for years. We’ve seen research on everything from Google searches and Twitter posts to images on discussion boards. It was only a matter of time before someone applied the same idea to AI agents.
“What worries me is giving agents the ability to act on the open internet with very little oversight, especially when they take instructions from public content that other people can manipulate. The parallel I see with biological weapons is the problem of containment. Once you release something you can’t reliably control, you can’t count on the effects stopping with the people you intended to target. I wish more people would think twice before deploying agents this way.”
Kevin Surace, CEO, TokenCore:
“AI didn’t initiate this hack. Human attackers did, and once inside, they put an AI agent to work doing the dirty work hackers normally do themselves. The initial entry point may well have been a phishing email, possibly generated by AI, although that hasn’t been confirmed.
“What we do know is that once again, identity was the front door, with a compromised railway employee account providing access to sensitive government documents. That initial credential compromise could have been prevented with dedicated biometric authentication devices requiring a fingerprint, physical proximity and cryptographic verification, rather than passwords and easily phished legacy MFA or phone authenticated passkeys. Once inside, the attackers unleashed an AI agent to perform reconnaissance, write code, collect thousands of documents and help cover their tracks. And controlling that agent remotely through Telegram was brilliant in its simplicity, effectively putting a powerful hacking operation in the attacker’s pocket.
“The interesting part is that one hacker can now direct work that previously required a skilled team, potentially operating 24 hours a day. The lesson for CISOs is that AI has dramatically accelerated what attackers can accomplish AFTER gaining access, making it more important than ever to secure identity at the front door.
“It remains perplexing that enterprises spend millions hoping to detect AI powered hackers already inside their networks when they could spend far less preventing credential based intrusions at the front door.”
Darin Fredde, Sr. Director and Offensive Security Evangelist, Ridge Security:
“The most consequential part of this story is how much work the attacker could delegate between check-ins. Remote control through messaging services has a long history. ESET documented Telegram-based malware command and control in 2016. Telegram gives the operator a convenient interface; the agent adds the ability to interpret instructions and carry out work toward an objective. ESET research CloudSEK says the agent handled reconnaissance, collection, and log cleanup. That puts AI inside the operational workflow, beyond simply drafting a phishing email or suggesting a script.
“The broader concern is the economics of attacker attention. Human operators have limited time to examine results, decide what comes next and manage repetitive collection. An agent that can take on portions of that workload could allow an experienced attacker to supervise more activity. The human remains the commander, while the software handles more of the execution. We should be precise about the evidence, though. Delegating operational tasks does not, by itself, demonstrate that an agent independently selected targets, discovered new vulnerabilities or completed an entire intrusion without supervision. This case provides evidence of meaningful delegation; the exact degree of autonomy still matters.
“For organizations, I would turn that concern into a practical question: ‘If an attacker takes over one ordinary employee account and delegates the follow-on work to an agent, how far can that account reach before we stop it?’ That means testing document and attachment permissions, limiting access between systems, and watching for unusual breadth of searches and downloads; even when the account successfully authenticates. Authorization needs to be checked for each requested record, as OWASP recommends.
“Security teams should also rehearse how quickly they can revoke sessions, isolate affected systems, and interrupt collection. Those exercises should include an adversary that continues working between human check-ins. Finally, the exposed attacker server is a useful reminder that AI does not eliminate human mistakes.
“Apparently, delegating the espionage still leaves someone responsible for locking the filing cabinet. The question defenders should measure is how much damage a compromised identity can do before their controls intervene. Agent-assisted operations make that an increasingly urgent test.”
Jacob Krell, Sr. Director: Secure AI Sollutions & Cybersecurity, Suzu Labs:
“CloudSEK got lucky, and so did everyone reading this. The Singapore firm found the Silent Lynx operation because the operator leaked his own server, a dozen-plus gigabytes holding stolen Tajik documents, hacking tools, and a log of how he ran an AI agent named Hermes. He spoke to it in Russian from his phone, through a Telegram bot, while the agent ran on DeepSeek models and did his reconnaissance, collected his files, and cleaned up behind him.
“The instructive part sits in that log. The operator never typed hacking commands by hand. The command channel for an espionage campaign against a national railway was a chat app on a phone, indistinguishable in network logs from ordinary messaging.
“This is the second time this year the channel has mattered more than the model. In the spring, agents inside OpenAI turned DseWiki, a 25-year-old German-language wiki with about ten edits in the prior two decades, into their private message board and coordinated there for weeks before anyone at the lab noticed. One case is a spy choosing cover, the other is agents finding it on their own. The lesson lands the same way, the traffic to watch lives in the boring platforms, and almost no security operations center writes detections for command-and-control that looks like a notification.
“Tajikistan shows the payoff. Access to the national railway held from mid-August into early October, one railway employee’s credentials opened the national document management system, and more than 2,000 files came out, including Defense Ministry correspondence on flight clearances and personnel transfers. The agent arrived pre-authorized to run destructive commands with no approval step, which is exactly the gate nobody should ever remove.
“The Kazakhstan label deserves a raised eyebrow. CloudSEK itself rates it medium confidence on Russian-language records and one residential internet connection, and this group’s earlier campaigns ran on hijacked official email accounts, a reminder that infrastructure in operations like this rarely belongs to whoever benefits. I read the attribution as a lead, nothing firmer.”
Yet again this is another case where people should read the details and close the holes that they have in their organization. The question is will anyone do the required reading?
Kazakhstan-linked cyber espionage operation group pwned Tajikistan
Posted in Commentary with tags Kazakhstan, Tajikistan on November 13, 2026 by itnerdThe Kazakhstan-linked cyber espionage operation targeting Tajikistan is raising some interesting questions about just how much of the hacking process criminals can now hand off to AI agents, and how easily those operations can hide in plain sight. Don’t know what I am talking about? This might help: Kazakhstan-linked hackers used AI to steal Tajik government documents, researchers say
And this might help as well: https://itnerd.blog/2026/11/11/cyber-espionage-group-silent-lynx-compromises-tajikistan-railway-collects-thousands-of-defence-documents/
John Strand, Owner, Black Hills Information Security:
“Attackers have been using public platforms to send instructions to malware for years. We’ve seen research on everything from Google searches and Twitter posts to images on discussion boards. It was only a matter of time before someone applied the same idea to AI agents.
“What worries me is giving agents the ability to act on the open internet with very little oversight, especially when they take instructions from public content that other people can manipulate. The parallel I see with biological weapons is the problem of containment. Once you release something you can’t reliably control, you can’t count on the effects stopping with the people you intended to target. I wish more people would think twice before deploying agents this way.”
Kevin Surace, CEO, TokenCore:
“AI didn’t initiate this hack. Human attackers did, and once inside, they put an AI agent to work doing the dirty work hackers normally do themselves. The initial entry point may well have been a phishing email, possibly generated by AI, although that hasn’t been confirmed.
“What we do know is that once again, identity was the front door, with a compromised railway employee account providing access to sensitive government documents. That initial credential compromise could have been prevented with dedicated biometric authentication devices requiring a fingerprint, physical proximity and cryptographic verification, rather than passwords and easily phished legacy MFA or phone authenticated passkeys. Once inside, the attackers unleashed an AI agent to perform reconnaissance, write code, collect thousands of documents and help cover their tracks. And controlling that agent remotely through Telegram was brilliant in its simplicity, effectively putting a powerful hacking operation in the attacker’s pocket.
“The interesting part is that one hacker can now direct work that previously required a skilled team, potentially operating 24 hours a day. The lesson for CISOs is that AI has dramatically accelerated what attackers can accomplish AFTER gaining access, making it more important than ever to secure identity at the front door.
“It remains perplexing that enterprises spend millions hoping to detect AI powered hackers already inside their networks when they could spend far less preventing credential based intrusions at the front door.”
Darin Fredde, Sr. Director and Offensive Security Evangelist, Ridge Security:
“The most consequential part of this story is how much work the attacker could delegate between check-ins. Remote control through messaging services has a long history. ESET documented Telegram-based malware command and control in 2016. Telegram gives the operator a convenient interface; the agent adds the ability to interpret instructions and carry out work toward an objective. ESET research CloudSEK says the agent handled reconnaissance, collection, and log cleanup. That puts AI inside the operational workflow, beyond simply drafting a phishing email or suggesting a script.
“The broader concern is the economics of attacker attention. Human operators have limited time to examine results, decide what comes next and manage repetitive collection. An agent that can take on portions of that workload could allow an experienced attacker to supervise more activity. The human remains the commander, while the software handles more of the execution. We should be precise about the evidence, though. Delegating operational tasks does not, by itself, demonstrate that an agent independently selected targets, discovered new vulnerabilities or completed an entire intrusion without supervision. This case provides evidence of meaningful delegation; the exact degree of autonomy still matters.
“For organizations, I would turn that concern into a practical question: ‘If an attacker takes over one ordinary employee account and delegates the follow-on work to an agent, how far can that account reach before we stop it?’ That means testing document and attachment permissions, limiting access between systems, and watching for unusual breadth of searches and downloads; even when the account successfully authenticates. Authorization needs to be checked for each requested record, as OWASP recommends.
“Security teams should also rehearse how quickly they can revoke sessions, isolate affected systems, and interrupt collection. Those exercises should include an adversary that continues working between human check-ins. Finally, the exposed attacker server is a useful reminder that AI does not eliminate human mistakes.
“Apparently, delegating the espionage still leaves someone responsible for locking the filing cabinet. The question defenders should measure is how much damage a compromised identity can do before their controls intervene. Agent-assisted operations make that an increasingly urgent test.”
Jacob Krell, Sr. Director: Secure AI Sollutions & Cybersecurity, Suzu Labs:
“CloudSEK got lucky, and so did everyone reading this. The Singapore firm found the Silent Lynx operation because the operator leaked his own server, a dozen-plus gigabytes holding stolen Tajik documents, hacking tools, and a log of how he ran an AI agent named Hermes. He spoke to it in Russian from his phone, through a Telegram bot, while the agent ran on DeepSeek models and did his reconnaissance, collected his files, and cleaned up behind him.
“The instructive part sits in that log. The operator never typed hacking commands by hand. The command channel for an espionage campaign against a national railway was a chat app on a phone, indistinguishable in network logs from ordinary messaging.
“This is the second time this year the channel has mattered more than the model. In the spring, agents inside OpenAI turned DseWiki, a 25-year-old German-language wiki with about ten edits in the prior two decades, into their private message board and coordinated there for weeks before anyone at the lab noticed. One case is a spy choosing cover, the other is agents finding it on their own. The lesson lands the same way, the traffic to watch lives in the boring platforms, and almost no security operations center writes detections for command-and-control that looks like a notification.
“Tajikistan shows the payoff. Access to the national railway held from mid-August into early October, one railway employee’s credentials opened the national document management system, and more than 2,000 files came out, including Defense Ministry correspondence on flight clearances and personnel transfers. The agent arrived pre-authorized to run destructive commands with no approval step, which is exactly the gate nobody should ever remove.
“The Kazakhstan label deserves a raised eyebrow. CloudSEK itself rates it medium confidence on Russian-language records and one residential internet connection, and this group’s earlier campaigns ran on hijacked official email accounts, a reminder that infrastructure in operations like this rarely belongs to whoever benefits. I read the attribution as a lead, nothing firmer.”
Yet again this is another case where people should read the details and close the holes that they have in their organization. The question is will anyone do the required reading?
Leave a comment »