AI-generated image
A hacking group allegedly linked to Kazakhstan deployed artificial intelligence (AI) to exfiltrate more than 2,000 documents concerning Tajikistan's national security, Reuters reports, citing an investigation by Singapore-based cybersecurity firm CloudSEK.
Researchers uncovered traces of the intrusion after the attackers inadvertently left one of their servers exposed to the public internet. Analyzing the data on the server allowed analysts to reconstruct the cyberattacks. They discovered that the hackers used Hermes, a framework designed to deploy autonomous AI agents capable of planning operations, executing software, gathering intelligence, and compiling reports independently.
According to CloudSEK, the hackers began using Hermes for reconnaissance in mid-August 2026. Weeks later, they compromised Tajikistan's state electronic document management system. An AI agent generated custom scripts to download, catalog, and fragment documents into smaller packets, streamlining exfiltration. As a result, the attackers stole over 2,000 records, including sensitive files on defense and national security.
The investigation also revealed evidence of intrusions into Tajikistan's railway network infrastructure and Smart Forestry, a digital management platform used in Uzbekistan's forestry sector. In addition, the exposed server contained phishing lures crafted for organizations in Turkmenistan, though researchers found no evidence that those attacks were successfully carried out.
Security analysts attribute the campaign to Silent Lynx, a cyberespionage group previously linked to attacks on government bodies across post-Soviet states. The suspected connection to Kazakhstan rests on circumstantial evidence: the hackers operated in Russian, their activity mirrored Kazakh business hours, and some server connections routed through internet networks in the country. However, researchers have not identified who directs the group and presented no evidence implicating Kazakh government agencies.
Reuters sought comment from authorities in Kazakhstan and Tajikistan, but received no response prior to publication. Journalists were also unable to reach representatives of Silent Lynx.
ℹ️ In October 2026, Cisco Talos and Recorded Future released joint research detailing cyberespionage operations targeting government institutions across post-Soviet states. According to their findings, the threat actors had operated since at least January 2025, pursuing diplomatic correspondence, economic policy, energy, water management, and agriculture. Researchers assessed the probability of a Kazakh nexus as moderate, cautioning that available data remains insufficient to definitively determine the attackers' origin or state sponsorship.
