{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/silent-lynx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Silent Lynx"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["espionage","ai-enabled","data-exfiltration","central-asia"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eSilent Lynx, a hacking group previously associated with espionage campaigns across Central Asia, has been observed leveraging an AI agent named Hermes to facilitate malicious operations. CloudSEK researchers identified an exposed server containing stolen government documents and evidence that the group used the Hermes AI agent, powered by DeepSeek models, to automate tasks such as reconnaissance, data collection, and log erasure. The operator controls the agent via a Telegram bot, allowing for remote command execution. The group maintains access to government networks, with confirmed activity against the Tajikistan national railway and electronic document management systems, and evidence suggesting preparation for further phishing activity against Turkmenistan.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access to government networks (e.g., Tajikistan national railway).\u003c/li\u003e\n\u003cli\u003eDeployment and interaction with the Hermes AI agent via a Telegram bot interface.\u003c/li\u003e\n\u003cli\u003eAutomated reconnaissance, data collection, and log clearing using the AI agent.\u003c/li\u003e\n\u003cli\u003eLarge-scale data exfiltration from government document management platforms.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSilent Lynx compromised Tajikistan's national railway network and the country's electronic document management platform. Stolen materials include internal correspondence from the Defense Ministry, the National Guard, the State Committee for National Security, and the State Investment Committee, affecting over 100 government organizations. Evidence also indicates the compromise of a server supporting Uzbekistan's Smart Forestry initiative.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor for anomalous mass-file transfer activity, specifically targeting large volumes of documents downloaded from internal management platforms.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized automated tools and script execution on critical infrastructure systems and internal file servers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T14:24:59Z","date_published":"2026-11-12T14:24:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-silent-lynx-ai/","summary":"The threat actor Silent Lynx is utilizing an AI agent named Hermes to automate reconnaissance, data exfiltration, and log clearance during cyberespionage operations targeting Central Asian government infrastructure.","title":"Silent Lynx: Espionage operations using AI agents for automation","url":"https://feed.craftedsignal.io/briefs/2026-11-silent-lynx-ai/"}],"language":"en","title":"CraftedSignal Threat Feed - Silent Lynx","version":"https://jsonfeed.org/version/1.1"}