SILENT LYNX · CMP-202611-imixuw · Other
NO FIX YET · SEE WHAT TO DO
CloudSEK found an exposed server of the Silent Lynx espionage group. It held tools, stolen data and records of the AI agent (open-source Hermes on DeepSeek models, run from a Telegram bot, with destructive commands pre-approved) from April to October 2026. Confirmed victims: Tajikistan's national railway network (access from at least mid-August to early October 2026); through one railway employee's login, Tajikistan's government electronic document system (thousands of Defense Ministry documents and more than 100 government organizations); and a server of Uzbekistan's Smart Forestry platform (webshell, still active when found). Turkmenistan Railways ticket and Ahal regional administration lures were built and tested in October 2026, pointing to a coming campaign against Turkmenistan. How it gets in: a shortcut (.lnk) file with a PDF icon, in a ZIP, a password-protected ZIP or an ISO, that opens a decoy PDF and runs hidden PowerShell. Attribution to Kazakhstan: medium confidence.
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
No product ranges from the sources yet.
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
first public Nov 11, 2026 · 1 source