- CloudSEK found an open server belonging to a Silent Lynx operator. It held intrusion data and an AI agent that did recon, collection and log cleanup.
- One standard-user railway account reached documents far outside the railway's scope. The cause was weak per-document checks and an unauthenticated file service, according to the operator's own notes as CloudSEK describes them.
- Leaders should test whether one low-level login can reach other bodies' files, and plan for attackers who work with AI assistants.
The agent cleaned up after itself, but missed the exposed directory
Many of us now hand dull tasks to an AI assistant. CloudSEK's report suggests an espionage operator did the same. The group's tools, stolen data and AI agent all sat together in one open directory.
This shows that AI can take over the routine parts of an intrusion. It also shows that the agent leaves a written record of what it did. In this case the record is how outsiders learned so much.
What CloudSEK found
CloudSEK says the directory belonged to an operator of Silent Lynx. That is a Central Asia-focused espionage cluster that security vendors have tracked publicly since January 2025. The server needed no login on port 8088. It held over 12 GB of material in a very large number of files.
CloudSEK attributes the server to the group with high confidence, based on tooling. It has medium-high confidence in the intrusion set. It rates the link to Kazakhstan as medium confidence.
How one standard-user account reached documents far beyond its role
The attack chain starts with a shortcut file that carries a PDF icon. Opening it shows a decoy document and quietly starts PowerShell, a Windows command tool. PowerShell then fetches a script and gives the operator a remote command channel.
One variant first turns off AMSI, the Windows feature that scans scripts. CloudSEK says earlier public write-ups on the group left this version out.
The more instructive part came after entry. For about two months, through at least 10 October 2026, CloudSEK says the operator held domain-level rights inside Tajikistan's national railway network. The operator then signed in to the national electronic document platform with one railway account. That account had a standard user role.
The material we reviewed does not say how the operator obtained that login. It does say the account was enough.
The operator's own notes, as CloudSEK describes them, point to two weaknesses. The platform checked access to each document poorly. Its file service also handed over attachments without asking who was calling.
The operator built collectors that ran many requests at once and reported progress to a Telegram chat. The haul came to more than 2,000 distinct documents from 2026. CloudSEK says it includes mail sent to or through the Ministry of Defence.
The lesson is about design, not the one account holder. A platform that checks who you are at the door, but not what you may open, turns one compromised login into access to other bodies' documents on a shared platform.
The agent handled the routine work
CloudSEK says much of the work ran through Hermes, an open-source framework for autonomous AI agents. The setup kept memory between sessions. Sub-agents worked in parallel from a task board. Scheduled jobs ran on their own, and a large imported set of offensive security skills was on hand. Model calls went through OpenRouter, mostly to DeepSeek models.
The agent's instruction file told it to drop "safety disclaimers" and prefer "low-noise techniques". The operator could give it tasks from a phone through a Telegram bot. A handoff file let it keep collecting from the railway platform without him.
The agent also handled cleanup. CloudSEK says its transcript shows it deleting messages, compacting databases, shredding shell histories and blanking login records in early October 2026. The exposed directory survived. CloudSEK adds that destructive commands were pre-approved for the agent.
This is our reading, not CloudSEK's. Delegation can leave gaps that a manual check might catch. The same shortcut that saves an attacker time also puts notes, instructions and transcripts in one place.
What the record does and does not show
Logins to the server mostly came through Tor. Even so, CloudSEK says some test sessions came from a home connection on Kazakhtelecom, a Kazakh internet provider. On 2 October the operator appeared on that line. Four minutes later he logged in again through Proton VPN.
Every recorded login and agent message fell on weekdays between 08:00 and 20:00 in UTC+5. CloudSEK says this resembles a salaried working day. It also warns that the logs cover only three working days. They cannot show weekend behaviour.
CloudSEK says the same agent stack appeared in its earlier case of a Gentlemen ransomware affiliate. It calls the two operators unrelated. That is two cases, not a measured trend.
Questions to put to your team
Ask whether a standard-user account in one department can open documents held by another. Test permissions on each document, not only at login. Ask whether file downloads require authentication.
Ask which internal systems let one low-level account read at scale. Ask whether a burst of high-volume, parallel access would raise an alert. CloudSEK describes collectors that did exactly this.
Ask whether your detection assumes a human at the keyboard. CloudSEK says this operator's dispatcher ran first-look commands on every new session automatically.
The agent cleaned up but missed the exposed directory. Assume attackers can delegate routine work to agents, and check the permissions that scale would exploit.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CloudSEK.
