An operator in Silent Lynx, an espionage group that targets Central Asian governments, used a self-hosted AI agent running on DeepSeek models for reconnaissance, data collection and log cleanup, the security firm CloudSEK said in a report on November 11. The firm found the agent’s files, conversation logs and memory on an exposed server.
The server, a Debian VPS open without authentication, held more than a dozen gigabytes of tooling and victim data and a timestamped record of the operator’s work from April to October 2026. CloudSEK said it assesses with high confidence that the exposed directory belongs to a Silent Lynx operator, based on implant code markers and build paths shared with published samples of the group’s malware.
The operator ran much of the work through Hermes, an open-source autonomous agent framework, under a persona that cast it as an elite offensive security specialist. The configuration routed model calls through OpenRouter, with DeepSeek V4.1 Flash as the primary model and Gemini 2.5 Flash running delegated sub-tasks. Destructive commands, including SQL DROP statements, were allowlisted to run without confirmation, and the hard stop on repeated tool failures was disabled. The operator gave instructions in Russian through a Telegram bot, which allowed tasking from a phone.
The operator held domain-level access to Tajikistan’s national railway network from mid-August to at least October 10, according to the report. Using the credentials of one railway employee with a standard user role, the operator logged into Tajikistan’s national electronic document management platform, which ministries use to exchange official correspondence, and built collectors to download from it at high concurrency. CloudSEK counted more than two thousand unique documents dated through 2026 that were addressed to or routed through the Defense Ministry, covering flight-clearance requests, personnel transfers, attaché postings and defense procurement. Smaller sets were tagged to the National Guard and the State Committee for National Security.
The railway folder held a handoff file written for the agent that described the working login chain for the document platform “so the agent could continue collection without the operator,” CloudSEK wrote. In early October, the agent ran its own cleanup, deleting messages, shredding shell histories and zeroing login records, but it missed the exposed directory.
Files on the server also showed command execution on the host behind Uzbekistan’s Smart Forestry GeoServer, gained through a webshell and a PostgreSQL account with superuser rights, though the operator did not obtain root. Lures impersonating Turkmenistan Railways and a Turkmen regional administration were built and tested in October, which CloudSEK said points to an upcoming campaign against Turkmenistan. The agent’s memory recorded an October “engagement” against Pakistan’s Ministry of Foreign Affairs and its national telecom provider, where a web application firewall repeatedly banned the operator’s IP address.
CloudSEK assesses with medium confidence that the operator has a Kazakhstan nexus: the operation runs in Russian, and the operator’s own test traffic came from a residential Kazakhtelecom connection. Cisco Talos reached the same medium-confidence assessment on October 14 for an overlapping cluster it tracks as UAT-6275. The findings do not establish a connection to the Kazakh government, The Record noted.
A framework named Hermes was also one of two used in an intrusion into Taiwan’s government systems in July, in which the attackers’ tool mapped 21 systems largely without human direction. Chainalysis said on October 30 that an attacker had used offensive agentic techniques to gain access to its systems. CloudSEK said it had found the same agent harness and model family in an earlier investigation of an unrelated affiliate of the Gentlemen ransomware operation.
Sources: CloudSEK, The Record
–
By the Control Plane Editorial Team