Silent Lynx Ran a Hermes AI Agent Through a Telegram Bot to Loot Tajikistan's Railway and Defence Ministry Documents
An exposed attacker server shows the Kazakhstan-linked Silent Lynx group used the open-source Hermes agent on DeepSeek models for reconnaissance, bulk document theft and log wiping inside Tajik government networks from August to October 2026.
What Happened
Security researchers have found one of the most detailed real-world cases so far of a state-aligned espionage group running an autonomous AI agent during live intrusions. The group is Silent Lynx, also tracked as YoroTrooper and Cavalry Werewolf. It used Hermes, an open-source AI agent framework, to help steal large volumes of government documents from Tajikistan. Researchers also linked it to intrusions in Uzbekistan and a planned phishing campaign against Turkmenistan.
The findings were published on 12 November 2026. They came to light because the attackers left one of their own servers exposed to the internet. It held more than a dozen gigabytes of data, including stolen documents, hacking tools and logs showing exactly how the operator directed the AI agent.
How the AI Agent Was Used
The logs give a rare look at how an AI-assisted operation works day to day:
- Configuration: Hermes was set up to act as "an offensive cybersecurity expert". It ran mainly on models from the Chinese AI company DeepSeek.
- Remote control: The operator wrote in Russian and connected the agent to a Telegram bot, so instructions could be sent from a phone.
- No safety brakes: The agent was allowed to run some potentially destructive commands without asking for further approval.
- Tasks: It helped with reconnaissance, data collection and erasing traces of the attackers' activity from compromised systems.
The agent didn't make the group more sophisticated. It made the group faster and more scalable, which matters when large amounts of data need to be found, sorted and taken out.
The Tajikistan Intrusion
The main operation targeted Tajikistan's national railway network. The attackers had extensive access from at least mid-August until early October 2026. During that time they:
- extracted databases containing login credentials
- stole internal documents and operational reports
- used one railway employee's credentials to get into Tajikistan's national electronic document management platform
- built automated tools to download files in bulk, including thousands of documents sent to or handled by the Ministry of Defence in 2026
The stolen material reportedly includes correspondence linked to the National Guard, the State Committee for National Security and the State Investment Committee, plus data on more than 100 government organisations and their staff. Some reports put the total at more than 2,000 national security-related documents. The full contents and classification of the files have not been independently confirmed.
Uzbekistan and Turkmenistan
In Uzbekistan, the attackers compromised a server supporting the government's Smart Forestry forest-monitoring platform. For Turkmenistan, researchers found malicious files disguised as official documents, including a fake railway ticket and a regional government report. These were created and tested in October, which points to a planned phishing campaign. Researchers could not tell whether those attacks succeeded.
Who Is Behind It
Silent Lynx has been active since at least 2022. It has gone after government, diplomatic and other institutions in Central Asia, Russia and Europe, with earlier targets in Kyrgyzstan, Turkmenistan, Tajikistan, Armenia, Belarus and Russia. In October 2025 it ran a months-long phishing campaign against Russian government agencies and industrial firms, using emails disguised as Kyrgyz government correspondence.
The researchers assess with medium confidence that the group has ties to Kazakhstan. That rests on its Russian-language communications and test connections from a Kazakh residential internet provider. Neither this assessment nor earlier ones show any link to the Kazakh government, and officials in Kazakhstan and Tajikistan did not immediately comment.
Why It Matters
Security vendors have spent the past year warning that attackers would start giving AI agents real control during intrusions. This case shows it happening, with logs to prove it:
- Open-source frameworks lower the bar. Hermes is freely available, and swapping in a cheap, permissive model is easy. Guardrails built into commercial assistants don't help when attackers run their own stack.
- Mobile command and control. Controlling an agent through Telegram lets one operator manage several intrusions from anywhere.
- Anti-forensics at machine speed. An agent told to clean up traces can do it more consistently than a tired human, which makes incident response harder.
- Operational mistakes still happen. The whole operation was exposed because of a basic server misconfiguration. AI didn't fix human sloppiness.
What Defenders Should Do
- Treat credential theft as the starting point. The railway compromise grew into access to a national document system through one employee's login. Enforce MFA on document management and internal portals, and watch for one account touching unusual systems.
- Detect bulk downloads. Automated harvesting creates sharp spikes in file requests. Alert on abnormal download volumes from document platforms, mail archives and file shares.
- Watch for cleanup behaviour. Log clearing, deleted shell history and timestamp tampering should trigger high-priority alerts, and logs should go to a central system attackers can't easily edit.
- Hunt for agent traffic. Unexpected outbound connections to LLM API endpoints or Telegram's bot API from servers that have no business using them are a useful new signal.
- Prepare staff for official-looking lures. Fake tickets and government reports remain the group's way in, so phishing awareness for public-sector staff still matters.
