---
id: "CMP-202611-imixuw"
page: "https://infrastack.ai/live/CMP-202611-imixuw"
kind: "campaign"
aliases: []
title: "Silent Lynx spies (likely Kazakhstan-based) use a DeepSeek-powered AI agent to break into Central Asian government and railway networks with PDF-looking shortcut files (CloudSEK)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-12T14:54:58+00:00"
updated_at: "2026-11-12T14:56:09+00:00"
sources: [{"source": "analyst", "url": "https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server", "first_seen_at": "2026-11-12T14:54:58+00:00", "cites": ["https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server"]}]
exploit_sources: []
---

# Silent Lynx spies (likely Kazakhstan-based) use a DeepSeek-powered AI agent to break into Central Asian government and railway networks with PDF-looking shortcut files (CloudSEK)

Link for people: https://infrastack.ai/live/CMP-202611-imixuw (this .md is for agents)

CloudSEK found an exposed server of the Silent Lynx espionage group. It held tools, stolen data and records of the AI agent (open-source Hermes on DeepSeek models, run from a Telegram bot, with destructive commands pre-approved) from April to October 2026. Confirmed victims: Tajikistan's national railway network (access from at least mid-August to early October 2026); through one railway employee's login, Tajikistan's government electronic document system (thousands of Defense Ministry documents and more than 100 government organizations); and a server of Uzbekistan's Smart Forestry platform (webshell, still active when found). Turkmenistan Railways ticket and Ahal regional administration lures were built and tested in October 2026, pointing to a coming campaign against Turkmenistan. How it gets in: a shortcut (.lnk) file with a PDF icon, in a ZIP, a password-protected ZIP or an ISO, that opens a decoy PDF and runs hidden PowerShell. Attribution to Kazakhstan: medium confidence.

_Summary, check and fix written by a model from the sources; labelled as such._

## Cause

How the attacker got in: a person was tricked (social-engineering). The record says the intrusion starts with a shortcut file in a ZIP or ISO that opens a decoy PDF and runs hidden PowerShell, which needs a person to open it, and the government document system was reached through one railway employee's login, which was then used against other organisations.

How it reached others: credentials stolen there were used against others (stolen-credential).

So it does not happen to you: Use phishing-resistant second factors on the accounts that matter, and never reset a factor on a phone call alone.

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#stolen-credential

## How to check

Network traffic to 89.125.213[.]123, including port 46125 (reverse shell) and 8088. Shortcut files with PDF icons in ZIP, ISO or password-protected archives, such as Отчёт_2026.pdf.lnk, that start hidden PowerShell with IEX(DownloadString) to fetch P.ps1. A decoy named Отчёт_2026.pdf. PowerShell that sets amsiInitFailed. Lures posing as Turkmenistan Railways e-tickets (Ashgabat to Turkmenabat) or an Ahal regional administration 2026 state programme report. Laplas and Chvost implants (see CloudSEK's report for hashes).

## Fix

Block 89.125.213[.]123. Block or quarantine .lnk files inside emailed ZIP and ISO attachments, and turn on PowerShell script block logging. Government, transport and diplomatic organizations in Central Asia should hunt for the indicators above, reset the logins of anyone who opened such a lure, and check document-management systems for bulk downloads from a single account.

## Timeline

- 2026-11-12T14:54:58+00:00 analyst https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server

## Documents

- [describes] Kazakhstan-linked hackers used AI agent to spy on Central Asian governments https://news.ycombinator.com/item?id=50467657
- [describes] Off the Rails: Inside an Exposed Silent Lynx Server https://www.cloudsek.com/blog/off-the-rails-inside-an-exposed-silent-lynx-server

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_