# Kazakhstan-linked hackers used AI agent to spy on Central Asian governments > Source: > Published: 2026-11-12 13:00:00+00:00 # Kazakhstan-linked hackers used AI agent to spy on Central Asian governments Suspected Kazakhstan-linked hackers used an artificial intelligence agent to help spy on Central Asian governments, steal sensitive documents and infiltrate critical infrastructure networks, according to new research. Singapore-based cybersecurity firm CloudSEK uncovered the operation after discovering an exposed server belonging to [Silent Lynx](https://therecord.media/hackers-pose-kyrgyz-officials-russia-cyber-espionage), a hacking group previously linked to espionage campaigns targeting Kyrgyzstan, Turkmenistan, Tajikistan, Armenia, Belarus and Russia. The server contained more than a dozen gigabytes of data, including stolen government documents, hacking tools and records showing how an attacker used an AI agent to automate parts of the operation. According to the [report](https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server) published Wednesday, the operator relied on Hermes, an open-source AI agent configured to act as an offensive cybersecurity expert. The system primarily used AI models developed by Chinese company DeepSeek. Unlike conventional chatbots, AI agents can execute commands, run software and carry out tasks on behalf of their users. The agent helped with reconnaissance, data collection and erasing traces of activity from compromised systems, researchers said. It was also configured to execute certain potentially destructive commands without requiring additional approval. The operator communicated with the agent in Russian and connected it to a Telegram bot, allowing the hacker to issue instructions remotely from a phone. ## Government networks compromised One of the group's most significant intrusions targeted Tajikistan, where the hackers maintained extensive access to the national railway network from at least mid-August through early October. After breaking into the network, the attackers gained access to several servers, extracted databases containing login credentials and stole internal documents and operational reports. The hackers also gained access to a much broader collection of government information. Using the credentials of a single railway employee, they logged into Tajikistan's national electronic document management platform, which government ministries and agencies use to exchange official correspondence. The group developed automated tools to download large quantities of files, including thousands of documents sent to or processed by Tajikistan's Defense Ministry in 2026. The stolen material also included correspondence associated with the National Guard, the State Committee for National Security and the State Investment Committee, as well as information about more than 100 government organizations and their employees. CloudSEK also found evidence the group had compromised a server supporting Uzbekistan's Smart Forestry initiative, a government platform used to monitor and manage forest resources. Additionally, the exposed server contained malicious files disguised as official documents from Turkmenistan, including a railway ticket and a regional government report. The files were created and tested in October, suggesting the group was preparing another phishing campaign. Researchers did not establish whether the attacks against Turkmenistan had succeeded. CloudSEK assessed with medium confidence that Silent Lynx has ties to Kazakhstan, citing Russian-language communications and test connections originating from a residential internet provider in the country. Those findings support earlier [assessments](https://therecord.media/kazakhstan-hackers-target-governments-commonwealth-of-independent-states-yorotrooper-cisco) by cybersecurity researchers that the group is likely based in Kazakhstan, although they do not establish any connection to the Kazakh government. Also tracked as Cavalry Werewolf and YoroTrooper, Silent Lynx has been active since at least 2022 and has previously targeted government agencies, diplomatic organizations and other institutions across Central Asia, Russia and Europe. In October 2025, the group [launched](https://therecord.media/hackers-pose-kyrgyz-officials-russia-cyber-espionage) a months-long cyberespionage campaign against Russian government agencies and industrial firms, using phishing emails disguised as Kyrgyz government correspondence. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.