Kazakhstan-Linked Hackers Used AI to Steal Tajik Defense Documents, Researchers Say

Hackers used AI to steal more than 2,000 documents that passed through Tajikistan’s Defense Ministry, according to cybersecurity firm CloudSEK. The company traced the theft to Silent Lynx, a group researchers have linked to Kazakhstan. The stolen documents included flight clearance requests, records of military personnel transfers, and reports on construction in border areas. In its November 11 report, the Singapore-based company said it had pieced together the operation from records on a server the hackers inadvertently left open to the public. Around mid-August, the group began using Hermes Agent, an open-source AI tool, to scout potential targets. A few weeks later, the hackers gained access to Tajikistan’s electronic document system through a railway employee’s account. Hermes then wrote a program to collect and organize the documents for transfer. The server records included instructions directing the agent to carry out its work in secret. “Instead of typing hacking commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports,” CloudSEK told Reuters. Similarities to tools used in earlier attacks gave CloudSEK high confidence that the server belonged to a Silent Lynx operator. CloudSEK linked the operator to Kazakhstan with medium confidence, citing Russian-language records and a residential internet connection in the country. Earlier researchers had also noted that the group was active during local business hours. The evidence does not establish whether the group acted on behalf of the Kazakh government. In findings published on October 14, researchers from Recorded Future and Cisco Talos described a wider campaign against Central Asian governments. Silent Lynx used hijacked official email accounts to gain access to government computers. Exposed working files helped the researchers trace the group’s interest in agencies holding information on regional diplomacy and natural resources. The Indian cybersecurity company Seqrite named the group Silent Lynx in January 2025. Its researchers found that the hackers had sent an email from the hijacked account of an employee at the National Bank of the Kyrgyz Republic. The attachment contained a malicious program and what appeared to be a United Nations meeting invitation.