Threats · 17h ago
CloudSEK found evidence that suspected Kazakhstan-linked group Silent Lynx used the Hermes AI agent in an espionage operation, maintaining access to Tajikistan’s railway network from at least mid-August through early October and stealing thousands of government documents.
The operator could send instructions to Hermes through Telegram, and the agent could perform tasks such as reconnaissance, collecting data and erasing traces—not just offer suggestions. But the route into Tajikistan’s government-wide document platform was a railway employee’s credentials: automated tools then downloaded large volumes of files, including documents sent to or processed by the Defense Ministry.
For agencies and infrastructure operators connected to shared document systems, a railway breach can expose correspondence far beyond the railway itself. AI may speed up parts of an operation, but the reporting does not show that it enabled the credential-based access.
1 source covering this story
The Record from Recorded Future
Kazakhstan-linked hackers used AI agent to spy on Central Asian governments
Suspected Kazakhstan-linked hackers used an artificial intelligence agent to help spy on Central Asian governments, steal sensitive documents and infiltrate critical infrastructure networks, according to new research.
Part of the PlainSec briefing for 2026-11-13