Silent Lynx Hackers Leave Their Central Asian Spy Campaign Exposed

New findings published on October 14 suggest that hackers spying on Central Asian governments have been operating from Kazakhstan. The group, named Silent Lynx by researchers, used hijacked official email accounts to break into government computers. The hackers left some of their own working files unprotected online, allowing researchers to examine how they prepared and adapted their attacks. Their targets included agencies holding information about regional diplomacy and natural resources. The investigation was conducted by cybersecurity firm Recorded Future and Talos, a security research group at computer networking company Cisco. The two companies, both based in the United States, have not established whether the hackers were working for a government. Hijacked Official Email Accounts Seqrite, an Indian cybersecurity provider, gave the hackers the name Silent Lynx in January 2025. Its investigation found that they had sent malicious emails from an employee’s hijacked account at Kyrgyzstan’s central bank. A message from a real official’s address could make a dangerous attachment look like routine business. One message claimed that correspondence intended for Kyrgyzstan’s Finance Ministry had been sent to the central bank by mistake. Attached was what appeared to be a United Nations meeting invitation, packaged with a malicious program. Running it would allow the hackers to issue instructions to the recipient’s computer and send files through a chat they controlled on Telegram, the messaging app. In related attacks, investigators saw the hackers copying documents and collecting passwords saved in web browsers. One victim had left a file called passwords.txt on the desktop, which the attackers stole and could use to access other accounts. German cybersecurity company VMRay and independent researcher Pol Thill documented these thefts in February 2026. The Files That Gave Them Away Researchers Ashley Shen and Julian-Ferdinand Vögele, from Talos and Recorded Future, respectively, found three online folders where the hackers had left attack software and other tools publicly accessible. A program in one folder led them to an account on GitHub, a website where programmers store and share code. GitHub preserves earlier versions of files, so the researchers could see how the hackers had revised their software and changed the internet addresses used to control infected computers. Moving to a new address did not erase the record, allowing investigators to continue tracking the operation. An attack file identified in April exploited a weakness in WinRAR, a program for unpacking compressed files. It was designed to install software that would start when the user next signed in, allowing the hackers to send instructions to the computer. A July 2025 update had fixed the weakness in WinRAR, but the attack could still work on computers where users had not updated the program. VMRay’s earlier investigation found that some operators had infected their own computers, exposing their browsing histories to the researchers. What Were They Looking For? The victims of those earlier attacks included water and hydropower institutions in Kyrgyzstan and water-related bodies in Uzbekistan and Tajikistan. Access to water records could be valuable in a region where decisions upstream affect...