Silent Lynx Hackers Leave Their Central Asian Spy Campaign Exposed

New findings published on October 14 suggest that hackers spying on Central Asian governments have been operating from Kazakhstan. The group, named Silent Lynx by researchers, used hijacked official email accounts to break into government computers. The hackers left some of their own working files unprotected online, allowing researchers to examine how they prepared and adapted their attacks. Their targets included agencies holding information about regional diplomacy and natural resources. The investigation was conducted by cybersecurity firm Recorded Future and Talos, a security research group at computer networking company Cisco. The two companies, both based in the United States, have not established whether the hackers were working for a government. Hijacked Official Email Accounts Seqrite, an Indian cybersecurity provider, gave the hackers the name Silent Lynx in January 2025. Its investigation found that they had sent malicious emails from an employee’s hijacked account at Kyrgyzstan’s central bank. A message from a real official’s address could make a dangerous attachment look like routine business. One message claimed that correspondence intended for Kyrgyzstan’s Finance Ministry had been sent to the central bank by mistake. Attached was what appeared to be a United Nations meeting invitation, packaged with a malicious program. Running it would allow the hackers to issue instructions to the recipient’s computer and send files through a chat they controlled on Telegram, the messaging app. In related attacks, investigators saw the hackers copying documents and collecting passwords saved in web browsers. One victim had left a file called passwords.txt on the desktop, which the attackers stole and could use to access other accounts. German cybersecurity company VMRay and independent researcher Pol Thill documented these thefts in February 2026. The Files That Gave Them Away Researchers Ashley Shen and Julian-Ferdinand Vögele, from Talos and Recorded Future, respectively, found three online folders where the hackers had left attack software and other tools publicly accessible. A program in one folder led them to an account on GitHub, a website where programmers store and share code. GitHub preserves earlier versions of files, so the researchers could see how the hackers had revised their software and changed the internet addresses used to control infected computers. Moving to a new address did not erase the record, allowing investigators to continue tracking the operation. An attack file identified in April exploited a weakness in WinRAR, a program for unpacking compressed files. It was designed to install software that would start when the user next signed in, allowing the hackers to send instructions to the computer. A July 2025 update had fixed the weakness in WinRAR, but the attack could still work on computers where users had not updated the program. VMRay’s earlier investigation found that some operators had infected their own computers, exposing their browsing histories to the researchers. What Were They Looking For? The victims of those earlier attacks included water and hydropower institutions in Kyrgyzstan and water-related bodies in Uzbekistan and Tajikistan. Access to water records could be valuable in a region where decisions upstream affect...

Kazakhstan Announces Crackdown on Counterfeit Cellular Base Station Scheme

Kazakhstan’s Financial Monitoring Agency (AFM) has reported the dismantling of a cyber fraud scheme involving counterfeit cellular base stations. According to the agency, this is the first such case identified in the post-Soviet region. Authorities say the criminal group used the equipment to intercept data on a large scale and send phishing messages. According to the AFM, the attackers used a special device, a so-called SMS blaster that imitated the operation of mobile operator base stations. The device generated a strong signal within a radius of up to 300 meters, causing mobile phones to connect to it automatically and switch to a less secure network. This allowed the attackers to bypass operators' security mechanisms. After connecting, subscribers received fake SMS messages purportedly sent on behalf of well-known companies, offering the chance to redeem accumulated bonuses. Clicking the link led to phishing websites, where users were prompted to select products and then enter personal information, including phone number, full name, bank details, CVV code, and SMS confirmation codes. This enabled the attackers to access confidential information and funds. According to the agency, the equipment was placed in vehicles and used while in motion to expand coverage and avoid detection. The messages were sent primarily in crowded areas, such as markets and near shopping and entertainment centers. The devices’ technical capabilities allowed them to send up to 100,000 messages per hour, significantly increasing the potential scale of the fraud. The operation to disrupt the group’s activities was carried out by the AFM under the coordination of the Prosecutor General’s Office, with the participation of cybersecurity specialists from a mobile operator. The uncovered scheme comes amid a broader rise in telephone and internet fraud in Kazakhstan. As previously reported by The Times of Central Asia, nearly 85 million fraudulent calls were blocked in the country in 2025. At the same time, authorities are introducing additional regulatory measures, including mandatory biometric identification for mobile subscribers, aimed at strengthening efforts to combat digital crime.