An espionage operator left the door open. CloudSEK found an unauthenticated open directory on a server belonging to Silent Lynx, a Central Asia-focused spying cluster, holding more than a dozen gigabytes of tooling, stolen government data and the logs of the AI agent the operator used to run intrusions, CloudSEK's threat research team reports.
The records run from April to October 2026. They show months of access to Tajikistan's national railway, thousands of documents pulled from a Tajik government correspondence platform, a foothold on an Uzbek government forestry system, and lures built for a coming campaign against Turkmenistan.
One railway login opened a ministry's mail
The server, 89[.]125[.]213[.]123, was exposed without authentication on port 8088. Its Ligolo pivot database records a live tunnel through a Tajik railway host from mid-August to at least October 10. Inside, the operator enumerated dozens of Windows hosts, gained admin access with plaintext passwords and NTLM hashes, produced several domain credential dumps including Administrator and krbtgt, copied internal reports, and harvested default passwords for network equipment at the railway's upstream ISP.
The biggest haul came from Tajikistan's national electronic document management (EDO) platform, which ministries use to exchange official correspondence. Using the single-sign-on credentials of one railway employee with an ordinary user role, the operator pulled documents far outside the railway's scope; the operator's own notes describe weak per-document authorization checks and an attachment service that required no authentication. The output includes more than two thousand unique documents dated through 2026 addressed to or routed through the Ministry of Defence, covering flight-clearance requests, personnel transfers, attaché postings, procurement enquiries and air-defence cooperation, plus smaller sets tied to the National Guard and the State Committee for National Security.
In Uzbekistan, the operator reached command execution on the host behind the Smart Forestry GeoServer through malicious WAR files, a webshell and a PostgreSQL superuser login abused to open a reverse shell, though CloudSEK says it never obtained root.
An AI agent with destructive commands pre-approved
Much of the work ran through Hermes, an open-source autonomous agent framework on the same server, branded "Strix". It routed model calls through OpenRouter, mostly to DeepSeek V4.1 Flash, with Gemini 2.5 Flash for delegated sub-tasks. Its configuration let shell heredocs and SQL DROP run without confirmation and disabled the tool-loop hard stop. The operator tasked it in Russian, including through a Telegram bot, and had it wipe logs and shell histories in early October. The cleanup missed the exposed directory.
Tor, apart from a home line in Kazakhstan
CloudSEK ties the server to Silent Lynx with high confidence through implant code: Laplas and Chvost reverse shells, including Chvost's distinctive string block, plus a previously unreported generation of Windows service-installer wrappers and a shortcut lure that switches off AMSI script scanning. Most logins came through Tor, but on October 2 the operator logged in from a residential Kazakhtelecom connection, then switched to Proton VPN four minutes later. Every recorded login and agent message fell between 08:00 and 20:00 Kazakhstan time. CloudSEK assesses a Kazakhstan nexus with medium confidence, in line with earlier vendor reporting on the group, which IntelFusions profiles under YoroTrooper. For earlier Kazakhstan-linked espionage in the region, see our October report.
Watch for railway and Ahal lures in Turkmenistan
- The kit already holds a decoy Turkmenistan Railways e-ticket and an executable lure referencing the Ahal regional administration's 2026 state programme report. Treat PDF-icon shortcut files inside ZIP, password-protected archives or ISO images as suspect.
- Alert on PowerShell spawned from .lnk files that downloads and runs a remote script, and on scripts setting amsiInitFailed through reflection.
- Block 89[.]125[.]213[.]123 and the operator domain foreverpeace[.]ru.
- Enforce per-document authorization on government document platforms, so one user account cannot read other agencies' correspondence.
The operator built an agent to erase its tracks and still lost the one folder that mattered. Spies are adopting the same AI tooling as everyone else, and so far they are just as careless about where they leave it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.