> ## Content Index
> Fetch the complete content index at: https://www.cyberdelegate.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Silent Lynx espionage campaign exploits Central Asian government networks with AI‑driven tools
- URL: https://www.cyberdelegate.com/silent-lynx-espionage-campaign-exploits-central-asian-government-networks-with-ai-driven-tools/
- Published: 2026-11-13T20:10:41.000Z
- Updated: 2026-11-13T20:10:40.000Z
- Description: Silent Lynx used a self‑hosted AI agent and custom malware to infiltrate Tajik, Uzbek and Turkmen government systems, stealing thousands of documents and persisting in critical infrastructure.
- Author: The CyberDiplomat
- Tags: Online Fraud & Scams, Global, espionage, APT, AI‑agents, Central Asia, malware, #crawler

Security firm CloudSEK uncovered a sophisticated espionage operation run by the group known as Silent Lynx (also called Cavalry Werewolf and YoroTrooper). The attackers leveraged a self‑hosted AI agent, dubbed Hermes and built on DeepSeek models, to automate reconnaissance, data collection, log cleanup and even pre‑approved destructive commands across several Central Asian government networks.

## What happened

The first evidence appeared in an open directory exposed by Silent Lynx, showing tooling and victim data from April 2026 onward. The directory revealed persistent domain‑level access to transport‑sector networks and a compromised employee account used to harvest government correspondence. A geospatial platform run by a government agency was breached via a webshell that granted database access and long‑term persistence.

## Technical details

Malware implants matched the known Laplas and Chvost families, but also introduced new service‑installer and AMSI‑bypass variants. The infection chain delivered a PDF‑icon shortcut that executed a PowerShell reverse shell through a script named P.ps1\. Server logins were routed through Tor, while test sessions originated from a residential Kazakhtelecom connection. The exposed server (IP 89.125.213.123) is a Debian VPS on Baxet Group infrastructure, unauthenticated on port 8088.

## Who was targeted

From mid‑August to early October 2026, Silent Lynx accessed Tajikistan’s national railway network, using a single employee’s credentials to infiltrate the electronic document‑management platform shared by multiple ministries. Thousands of documents were exfiltrated, including files from the Defense Ministry, National Guard, State Committee for National Security, State Investment Committee and over 100 other government organisations. Evidence also points to compromise of a server supporting Uzbekistan’s Smart Forestry initiative and to lures impersonating Turkmenistan Railways and a regional administration, which were built and tested in October 2026 for a planned phishing campaign.

## Why it matters

The operation demonstrates how AI‑driven agents can streamline traditional APT tactics, lowering the skill barrier for large‑scale data theft and persistence in critical infrastructure. The stolen material contains sensitive defence and security information that could be weaponised or sold on underground markets, posing a risk not only to the affected states but also to any entities that rely on shared regional data.

## How to protect yourself

- Verify the authenticity of any document or shortcut that claims to be from a government agency, especially if it appears as a PDF icon.
- Restrict PowerShell execution policies and monitor for unusual reverse‑shell traffic, particularly on uncommon ports.
- Implement multi‑factor authentication for all privileged accounts and regularly rotate credentials used for remote access.
- Audit and segment network access for critical infrastructure such as railways, geospatial platforms and forestry databases.
- Monitor outbound connections for Tor traffic or connections to unknown VPS providers.

If you suspect you have been targeted by a similar campaign, report the incident to India’s cybercrime helpline at 1930 or via [cybercrime.gov.in](https://cybercrime.gov.in/?ref=cyberdelegate.com).

### Sources

- [cloudsek.com (official)](https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server?ref=cyberdelegate.com)
- [The Record](https://therecord.media/kazakhstan-hackers-central-asia?ref=cyberdelegate.com)

*This brief was prepared with AI assistance from the sources above and reviewed by our editors.*