CloudSEK says an espionage group used an AI agent against Tajikistan's railway network

The Silent Lynx espionage group used an artificial intelligence agent to automate part of its intrusions against Central Asian governments, according to research by Singapore-based cybersecurity firm CloudSEK published on November 11 and reported by The Record.

According to CloudSEK, the finding stems from an exposed server belonging to the group with more than a dozen gigabytes of data: stolen government documents, hacking tools and records of how the operator used Hermes, an open-source AI agent configured as an offensive cybersecurity expert and running mainly on models from Chinese company DeepSeek. The researchers say the agent helped with reconnaissance, data collection and erasing traces, and could execute some potentially destructive commands without additional approval.

The most significant intrusion, according to the research, affected the network of Tajikistan's national railway, where the attackers kept access from at least mid-August until early October, stole databases with credentials and, using one employee's credentials, logged into the national document management platform used by ministries. CloudSEK says a server for Uzbekistan's Smart Forestry initiative was also compromised.

CloudSEK links Silent Lynx to Kazakhstan with medium confidence, citing Russian-language communications and test connections from a residential provider in that country. Tajikistan's authorities have not commented in the sources consulted.

Developing story: the use of the AI agent and the scope of the intrusions are claimed only by CloudSEK; its original report and confirmation from the authorities or the affected entities are still needed.