Silent Lynx: Espionage operations using AI agents for automation

Silent Lynx, a hacking group previously associated with espionage campaigns across Central Asia, has been observed leveraging an AI agent named Hermes to facilitate malicious operations. CloudSEK researchers identified an exposed server containing stolen government documents and evidence that the group used the Hermes AI agent, powered by DeepSeek models, to automate tasks such as reconnaissance, data collection, and log erasure. The operator controls the agent via a Telegram bot, allowing for remote command execution. The group maintains access to government networks, with confirmed activity against the Tajikistan national railway and electronic document management systems, and evidence suggesting preparation for further phishing activity against Turkmenistan.

Attack Chain

1. Initial access to government networks (e.g., Tajikistan national railway).
2. Deployment and interaction with the Hermes AI agent via a Telegram bot interface.
3. Automated reconnaissance, data collection, and log clearing using the AI agent.
4. Large-scale data exfiltration from government document management platforms.

Impact

Silent Lynx compromised Tajikistan's national railway network and the country's electronic document management platform. Stolen materials include internal correspondence from the Defense Ministry, the National Guard, the State Committee for National Security, and the State Investment Committee, affecting over 100 government organizations. Evidence also indicates the compromise of a server supporting Uzbekistan's Smart Forestry initiative.

Recommendation

• Monitor for anomalous mass-file transfer activity, specifically targeting large volumes of documents downloaded from internal management platforms.
• Monitor for unauthorized automated tools and script execution on critical infrastructure systems and internal file servers.