Silent Lynx ran an autonomous AI agent in Central Asia breaches

CloudSEK says it found an exposed server belonging to the threat group Silent Lynx that was running an off-the-shelf AI agent to drive real intrusions into Central Asian government systems. The firm's report, "Off the Rails: Inside an Exposed Silent Lynx Server," was reported by The Record. It is a rare primary-source look at an APT wiring an autonomous agent into an active operation — and a useful calibration point for how much of that is real tradecraft versus convenience tooling.

What was on the server

The operator ran Hermes, an open-source AI agent "configured to act as an offensive cybersecurity expert," mostly on DeepSeek models. Per CloudSEK, the agent handled reconnaissance, data collection and erasing traces, and was configured to execute certain potentially destructive commands without requiring additional approval. The operator issued instructions in Russian and wired the agent to a Telegram bot so commands could be sent from a phone. The exposed server held over a dozen gigabytes, including the group's hacking tools.

Silent Lynx — also tracked as Cavalry Werewolf and YoroTrooper, active since at least 2022 — used the setup against:

• Tajikistan: the national railway network and the national electronic document-management platform, accessed with one railway employee's credentials. The haul included thousands of documents processed by Tajikistan's Defense Ministry in 2026 and correspondence tied to the National Guard, the State Committee for National Security and the State Investment Committee — material on 100-plus government organizations.
• Uzbekistan: a server supporting the "Smart Forestry" initiative.
• Turkmenistan: fake official documents — a railway ticket and a regional government report — created and tested in October. CloudSEK did not establish whether those attacks succeeded.

The Tajik railway intrusion ran from at least mid-August through early October.

Read it skeptically

This is the part the AI/LLM beat exists to flag. What the agent demonstrably did — recon, credential-driven lateral movement, bulk document collection, log cleanup — is standard post-access tradecraft that scripts have automated for years; the novelty is an LLM orchestrating it with a Telegram remote and auto-approval for destructive commands, not a new exploitation capability. The initial access here was a stolen employee credential, not anything the model found. And the exposure came from the operators' own opsec failure — an internet-facing server — not from the AI.

Attribution is hedged accordingly. CloudSEK assesses with medium confidence that Silent Lynx has ties to Kazakhstan, citing Russian-language communications and test connections from a Kazakh residential ISP. It does not establish any connection to the Kazakh government, and earlier research that places the group in Kazakhstan stops at the same line.

What to do

1. Watch for agent-shaped command cadence. An AI operator generates bursts of tightly sequenced recon and collection commands under one session — a signal distinct from hands-on-keyboard pacing in EDR and shell-history telemetry.
2. Assume auto-approved destructive actions. An agent cleared to run commands without confirmation can delete logs and data faster than a human; prioritize immutable, off-host logging.
3. The credential is still the front door. This operation started with one valid railway-employee login. Phishing-resistant MFA on remote access does more here than any AI-specific control.
4. Egress-filter inference APIs. Outbound calls to DeepSeek or other model endpoints from a server that has no business making them are a cheap, high-signal detection.

Context

This is the second concrete artifact in recent weeks of adversaries operationalizing AI agents rather than just talking about them, and it fits the pattern we flag on this beat: the AI accelerates the boring middle of an intrusion, while initial access and attribution stay stubbornly human. Treat "AI-driven attack" claims as a question about which phase was automated — here, it was collection and cleanup, not the breach itself.