{"id":"CMP-202611-imixuw","kind":"campaign","aliases":[],"related":[],"title":"Silent Lynx spies (likely Kazakhstan-based) use a DeepSeek-powered AI agent to break into Central Asian government and railway networks with PDF-looking shortcut files (CloudSEK)","description":null,"summary":"CloudSEK found an exposed server of the Silent Lynx espionage group. It held tools, stolen data and records of the AI agent (open-source Hermes on DeepSeek models, run from a Telegram bot, with destructive commands pre-approved) from April to October 2026. Confirmed victims: Tajikistan's national railway network (access from at least mid-August to early October 2026); through one railway employee's login, Tajikistan's government electronic document system (thousands of Defense Ministry documents and more than 100 government organizations); and a server of Uzbekistan's Smart Forestry platform (webshell, still active when found). Turkmenistan Railways ticket and Ahal regional administration lures were built and tested in October 2026, pointing to a coming campaign against Turkmenistan. How it gets in: a shortcut (.lnk) file with a PDF icon, in a ZIP, a password-protected ZIP or an ISO, that opens a decoy PDF and runs hidden PowerShell. Attribution to Kazakhstan: medium confidence.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-12T14:54:58+00:00","products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Network traffic to 89.125.213[.]123, including port 46125 (reverse shell) and 8088. Shortcut files with PDF icons in ZIP, ISO or password-protected archives, such as Отчёт_2026.pdf.lnk, that start hidden PowerShell with IEX(DownloadString) to fetch P.ps1. A decoy named Отчёт_2026.pdf. PowerShell that sets amsiInitFailed. Lures posing as Turkmenistan Railways e-tickets (Ashgabat to Turkmenabat) or an Ahal regional administration 2026 state programme report. Laplas and Chvost implants (see CloudSEK's report for hashes).","fix":"Block 89.125.213[.]123. Block or quarantine .lnk files inside emailed ZIP and ISO attachments, and turn on PowerShell script block logging. Government, transport and diplomatic organizations in Central Asia should hunt for the indicators above, reset the logins of anyone who opened such a lure, and check document-management systems for bulk downloads from a single account.","status":"open","published_at":null,"first_seen_at":"2026-11-12T14:54:58+00:00","triaged_at":"2026-11-12T14:54:58+00:00","updated_at":"2026-11-12T14:56:09+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-12T14:59:15Z","path":"stolen-credential","entry":"social-engineering","reason":"The record says the intrusion starts with a shortcut file in a ZIP or ISO that opens a decoy PDF and runs hidden PowerShell, which needs a person to open it, and the government document system was reached through one railway employee's login, which was then used against other organisations.","confidence":0.55}},"analyst_status":"done","analyst_note":null,"search":"'-202611':32A '100':121B '2026':82B,100B,152B 'access':90B 'activ':135B 'administr':144B 'agent':14A,59B 'ahal':142B 'ai':13A,58B 'approv':77B 'april':79B 'asian':19A 'attribut':192B 'august':96B 'base':7A 'bot':71B 'break':16A 'built':147B 'campaign':34B,157B 'central':18A 'cloudsek':30A,38B 'cmp':31A 'come':156B 'command':74B 'confid':196B 'confirm':83B 'data':53B 'decoy':186B 'deepseek':11A,65B 'deepseek-pow':10A 'defens':115B 'destruct':73B 'document':111B,117B 'earli':36B,98B 'early-warn':35B 'electron':110B 'employe':104B 'espionag':47B 'expos':41B 'file':29A,167B 'forestri':131B 'found':39B,137B 'get':162B 'govern':20A,109B,122B 'group':48B 'held':50B 'herm':63B 'hidden':190B 'icon':171B 'imixuw':33A 'iso':182B 'kazakhstan':6A,194B 'kazakhstan-bas':5A 'least':93B 'like':4A 'lnk':166B 'login':106B 'look':27A 'lure':145B 'lynx':2A,46B 'medium':195B 'mid':95B 'mid-august':94B 'ministri':116B 'model':66B 'nation':87B 'network':23A,89B 'octob':81B,99B,151B 'one':102B 'open':61B,184B 'open-sourc':60B 'organ':123B 'password':177B 'password-protect':176B 'pdf':26A,170B,187B 'pdf-look':25A 'platform':132B 'point':153B 'power':12A 'powershel':191B 'pre':76B 'pre-approv':75B 'protect':178B 'railway':22A,88B,103B,139B 'record':55B 'region':143B 'run':67B,189B 'server':42B,126B 'shortcut':28A,165B 'silent':1A,45B 'smart':130B 'sourc':62B 'spi':3A 'still':134B 'stolen':52B 'system':112B 'tajikistan':85B,107B 'telegram':70B 'test':149B 'thousand':113B 'ticket':140B 'tool':51B 'turkmenistan':138B,159B 'use':8A 'uzbekistan':128B 'victim':84B 'warn':37B 'webshel':133B 'zip':174B,179B","nicknames":["Silent Lynx","Cavalry Werewolf","YoroTrooper","ShadowSilk","UAT-6275","TAG-193","Laplas","Chvost"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["cavalrywerewolf","chvost","laplas","shadowsilk","silentlynx","tag193","uat6275","yorotrooper"],"ptokens":[],"labels":["campaign","earlywarning","high","other"],"campaign_type":"breach","search_a":"'-202611':32A 'agent':14A 'ai':13A 'asian':19A 'base':7A 'break':16A 'central':18A 'cloudsek':30A 'cmp':31A 'deepseek':11A 'deepseek-pow':10A 'file':29A 'govern':20A 'imixuw':33A 'kazakhstan':6A 'kazakhstan-bas':5A 'like':4A 'look':27A 'lynx':2A 'network':23A 'pdf':26A 'pdf-look':25A 'power':12A 'railway':22A 'shortcut':28A 'silent':1A 'spi':3A 'use':8A","search_b":"'100':121B '2026':82B,100B,152B 'access':90B 'activ':135B 'administr':144B 'agent':59B 'ahal':142B 'ai':58B 'approv':77B 'april':79B 'attribut':192B 'august':96B 'bot':71B 'built':147B 'campaign':34B,157B 'cloudsek':38B 'come':156B 'command':74B 'confid':196B 'confirm':83B 'data':53B 'decoy':186B 'deepseek':65B 'defens':115B 'destruct':73B 'document':111B,117B 'earli':36B,98B 'early-warn':35B 'electron':110B 'employe':104B 'espionag':47B 'expos':41B 'file':167B 'forestri':131B 'found':39B,137B 'get':162B 'govern':109B,122B 'group':48B 'held':50B 'herm':63B 'hidden':190B 'icon':171B 'iso':182B 'kazakhstan':194B 'least':93B 'lnk':166B 'login':106B 'lure':145B 'lynx':46B 'medium':195B 'mid':95B 'mid-august':94B 'ministri':116B 'model':66B 'nation':87B 'network':89B 'octob':81B,99B,151B 'one':102B 'open':61B,184B 'open-sourc':60B 'organ':123B 'password':177B 'password-protect':176B 'pdf':170B,187B 'platform':132B 'point':153B 'powershel':191B 'pre':76B 'pre-approv':75B 'protect':178B 'railway':88B,103B,139B 'record':55B 'region':143B 'run':67B,189B 'server':42B,126B 'shortcut':165B 'silent':45B 'smart':130B 'sourc':62B 'still':134B 'stolen':52B 'system':112B 'tajikistan':85B,107B 'telegram':70B 'test':149B 'thousand':113B 'ticket':140B 'tool':51B 'turkmenistan':138B,159B 'uzbekistan':128B 'victim':84B 'warn':37B 'webshel':133B 'zip':174B,179B","search_c":"","cause_entry":"social-engineering","cause_path":"stolen-credential","disclosures_checked_at":"2026-11-12T15:05:39+00:00","first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-imixuw","url":"https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T14:54:58+00:00","fetched_at":"2026-11-12T14:54:58+00:00","note":null,"cites":["https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server"]}],"documents":[{"id":135493,"url":"https://news.ycombinator.com/item?id=50467657","title":"Kazakhstan-linked hackers used AI agent to spy on Central Asian governments","kind":"post","source":"hackernews","publisher":null,"text":"Kazakhstan-linked hackers used AI agent to spy on Central Asian governments\nhttps://therecord.media/kazakhstan-hackers-central-asia\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-12T14:20:29+00:00","relation":"describes","confidence":null,"note":null},{"id":135716,"url":"https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server","title":"Off the Rails: Inside an Exposed Silent Lynx Server","kind":"blog","source":"analyst","publisher":null,"text":"CloudSEK TRIAD: exposed Silent Lynx server 89.125.213[.]123:8088 (Baxet VPS). LNK phishing (PDF icon, ZIP/password ZIP/ISO), decoy PDF, P.ps1 reverse shell to 89.125.213[.]123:46125, AMSI bypass variant, Отчёт_2026.pdf.lnk. Laplas and Chvost implants. Tajik railway network access mid-Aug to early Oct 2026, Tajik government e-document platform, Uzbekistan Smart Forestry webshell, Turkmenistan Railways ticket lures Oct 2026. Hermes AI agent on DeepSeek, Telegram bot, destructive commands pre-approved.","published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}