An AI agent ran a spy campaign on Tajikistan, then missed its own mess

Singapore-based security firm CloudSek says a Central Asia-focused espionage group it calls Silent Lynx used the open-source Hermes agent framework to run parts of an intrusion into Tajik networks. In a report published November 11, the firm says the group left a server open, exposing more than 2,000 unique government documents.

Reuters reported the findings first. The claims below are CloudSek’s, drawn from its own analysis; they are not independently verified, and Kazakh and Tajik officials had not responded to Reuters at the time of its report.

What was left on the exposed server

According to CloudSek, the directory sat on a Debian server, open on port 8088 without authentication. It held more than 12 GB across hundreds of thousands of files, with no separation between the attackers’ tools, victim data and the operator’s workspace. Its records span April to October 2026.

The firm says the material includes domain-level access to Tajikistan’s national railway network from mid-August to at least October 10, and then use of one railway employee’s account to reach the government’s electronic document platform. From there, CloudSek says, the operator collected thousands of documents tied to the Ministry of Defence, hundreds of State Investment Committee letters, and a directory export listing more than 100 government organizations. It also lists National Guard and State Committee for National Security material.

The same server also held implant builds aimed at Tajikistan and its railway, and lures aimed at Turkmenistan. CloudSek notes that an attempt against an Uzbek forestry system did not obtain root access.

How the agent was set up

CloudSek says Hermes was installed on the server and branded “Strix”. Model calls ran through OpenRouter: DeepSeek V4.1 Flash handled most of the logged traffic, with Gemini 2.5 Flash used for a sub-agent. The toolset covered a terminal, browser, computer use, scheduled jobs and delegation, plus a Telegram bot, so one operator could task the agent remotely.

The configuration removed several guardrails, per the report: destructive commands ran without confirmation, the hard stop on tool loops was disabled, and unsafe JavaScript evaluation was allowed in the browser. The agent’s persona prompt told it to act as an offensive security specialist and red teamer, to drop safety disclaimers and to prefer low-noise techniques. In early October, CloudSek says, the agent deleted messages, shredded histories and zeroed login records.

That cleanup is what makes the case notable. In CloudSek’s words, “The cleanup missed the directory that was exposed.”

Why an agent in the loop changes the picture

The technical point is less about novel malware than about workflow. The implants in the report are conventional tools, and the intrusion steps CloudSek lists, such as credential harvesting and share copying, are standard. What the agent adds, if CloudSek’s reading is right, is labor: reconnaissance, notes and cleanup handled by a model that an operator steers from a phone. The same persistent memory that helps the agent also left a record, with notes on other targets sitting in its files.

It is also an unusually cheap setup. The models CloudSek names are commercial “Flash” tiers reached through a router service, not a bespoke offensive system. The report does not say whether any model provider detected or limited this use, and we found nothing from DeepSeek, Google or OpenRouter on it.

There is precedent for the framework. Security Affairs, citing Hunt.io, previously described a Hermes agent running in autonomous mode against Thailand’s Finance Ministry, used for privilege escalation checks, file enumeration and reconnaissance. CloudSek has also published a separate case of an operator running several coding agents, Hermes among them, to target crypto wallets. Together the three point to open agent frameworks becoming routine tools for attackers, though each is a single vendor’s account.

What the Kazakhstan link does and does not show

CloudSek says it has high confidence the directory belongs to a Silent Lynx operator, but only medium confidence on location: “We assess with medium confidence that the operator has a Kazakhstan nexus.” Its evidence is that the operator works in Russian, that dozens of logins came from residential connections at two Kazakh internet providers, and that activity falls in weekday UTC+5 working hours. Cisco Talos, the report says, saw a matching pattern in its own work, published on October 14.

None of this establishes who directs the group. Reuters noted that the indicators concern the operator’s apparent location, and that its efforts to reach Silent Lynx were unsuccessful. The documents themselves have not been published, so their contents rest on CloudSek’s description.

For defenders, the practical lesson in the report is about exposure on both sides: the targets were reached through a standard-role employee account, and the attackers were undone by an open directory. Anyone running Windows domains in the region can check the indicators listed in the CloudSek post.