CloudSek says AI-assisted hackers stole Tajik government documents

CloudSek said the hackers began using Hermes for reconnaissance around mid-August and broke into Tajikistan’s electronic document system a couple of weeks later.[1] The attacker supplied instructions; Hermes then planned attacks, wrote and ran rules, kept notes and produced reports.[1] CloudSek also said the agent wrote a custom program to download and organize files, then divide them into chunks to make theft more effective.[1] The exposed data included instructions describing how the agent should see itself, operate and communicate with the hackers.[1] Those instructions called it an elite offensive security specialist and red teamer, a role that simulates covert attacks to test systems.[1]

In a separate account on its website, CloudSek said the exposed directory held evidence of operations from April through October 2026.[2] The company said the operator had persistent, domain-level access to transport-sector networks and used a compromised employee account to collect government correspondence at scale.[2] That correspondence included defence-related documents, according to CloudSek.[2] The company also reported that a government-run geospatial platform was accessed at host level through a webshell and database access, with persistence still in place when the directory was exposed.[2]

CloudSek said the hackers belonged to a group nicknamed Silent Lynx, which other researchers have linked to Kazakhstan.[1] Its website account said the operator’s server logins were routed through Tor, while the operator’s own test sessions came from a residential Kazakhtelecom connection.[2] CloudSek also said it found lures impersonating Turkmenistan Railways and a Turkmen regional administration that had been built and tested in October 2026.[2] The company said the lures pointed to a possible upcoming campaign against Turkmenistan.[2]

CloudSek said the exposed data showed that more advanced, espionage-focused hackers were also using AI for hacking operations.[1] Its website account describes a self-hosted AI agent running on DeepSeek that handled reconnaissance, collection and log cleanup, with destructive commands pre-approved.[2] The evidence also identifies Hermes as the framework used by the hackers, but does not explain the relationship between the Hermes and DeepSeek descriptions.[1][2] Kazakh and Tajik government officials did not immediately respond to requests for comment, and Reuters said efforts to reach Silent Lynx were unsuccessful.[1]